I opened a ticket which is actively being worked by someone. Thanks support.
If I set "Show Top Level Categories Only" to true in the widget setting, it only shows top level categories that I'm allowed to view per acl restrictions, but I have acl rules ignored for the store (there are 3 stores using a common code base and database, but different themes). If set it false, it properly ignores acl restristions. Nop-commerce v3.60.