Unless you’re making a quick test app for something, I think it’s mandatory to always start your project by setting your application security level to production. Especially when you’re learning development in Mendix as well.
It’s better to learn how to develop your application with security than having to redo a lot of stuff right when you want to go Live and come to the conclusion that you can’t deploy to production because your security settings aren’t set to production and they bar you from deploying to your Production environment.
So you have made sure it is not because of entity-access. Good.
Have you set the association to the right direction? You will only be able to get them over association of you read them from the start of the association-arrow to the end of it.