Yes, this is by design. If you need entity access the whole chain needs entity access. The reason behind it as far as I know (somebody from Mendix might give better reasoning) is that by standard microflows have access to the data.
Dear Nikel, It seems that it used to be the way you are asking about:
the "apply entity access" was indeed propagating down the line as you call microflows from a microflow that "applies entity access".
Apparently, it was found to be an issue and reported in the ticket no. 203152, and consequently fixed in modeller 5.09.0: https://world.mendix.com/display/ReleaseNotes/5.09.0