In Salesforce, the sharing context is determined by the definition of the class where a method is defined, not where it is invoked or instantiated. Since there's no "with sharing" or "without sharing" keyword in the class definition in the provided example, it operates in system context. In system context, Apex code has access to all objects and fields- object permissions, field-level security, sharing rules aren't applied for the current user. References: Apex Developer Guide