Ted answered my support case question:

Using restadmin, you override scoped permissions and instead take the root community permissions instead, providing the behavior that you had reported. Compare this behavior with the standard "rest" context object, and it should, in theory, work the way you expected.