Yes, displaying the wrong user is a symptom of it not enforcing security.
I’m not sure what idmap is. Does it allow the user numbers to be translated per folder?
Consider this setup: Two users on the server, Bob: 1001 and Jane 1002, and they have each been given ownership and exclusive access to separate folders.
Then you mount that to another machine where the user numbers are swapped. In that case, Bob gets Jane’s files and Jane gets Bob’s files.
Or worse, someone else on the network connects to the share with the 1001 user number. Then they get access to all of Bob’s files. This can be prevented by limiting access to the share from a single IP.