I have set my jenkins master node to "Only build jobs with label expressions matching this node".  I am doing this because I do not want builds to run on the master node and want users to automatically utilize the docker agent nodes.  However, if a freestyle job is created or a user specifies "agent none" in a pipeline script, the job runs on the master node.  I also attempted enabling Node based security and disabling the inheritance of permissions.

Why are builds without the proper label allowed to run on the master node?