check_relation does not check target
The method check_relation of ir.model.access is responsible to check if a relational field can be display to the user or not depending on the access right to the target.
The check on many2many does not work properly because it check the access on using the name of the target field instead of the name of the target Model.
This makes visible such field which could raise access error in the client.
There is no security risk here because it is just a cosmetic feature and not the real access right verification.