How can a user that doesn't have a CRM license or CRM security roles assigned still be able to see all apps and open them up?

How can a user that doesn't have a CRM license or CRM security roles assigned still be able to see all apps and open them up?
Hey!
For a user to access a Dynamics 365 environment, they need to fill the following conditions:
a) They need to be enabled in AzureAD.
b) They need to have a valid License. PowerApps licenses or Project Licenses allow allow a user to work with the underlying Dataverse layer and therefore, their user data becomes synchronized into the environment.
c) If the environment has a security group associated, they need to be part of that security group
d) Finally, they need to have a security role asssigned. Please note that sometimes, the security roles might be assigned to the default teams
Fom your description, looks like there is some other license providing user the access to the dataverse layer. And those users have a security role assigned through a team. In order to prevent this situation, is always a good Idea to restrict environment access by using a Security Group (point c)
Regards