rclone
does not circumvent access controls. It uses the official APIs for each cloud provider. It's the cloud provider that determines if you can see something or not. If any product allowed this then it's a security problem with the cloud provider.