why do drafts return as part of wp_query?

I have some code as plugin, which I call via AJAX from a page one the site. It gets two drop-down values and uses them in tax_query to fetch some posts. Question: why do drafts return amongst results by default? I need to uncomment 'post_status' => 'publish' to prevent this from happening.

User is not logged in, and the doc says

“Default value is ‘publish’, but if the user is logged in, ‘private’
is added. And if the query is run in an admin context, protected
statuses are added too. By default protected statuses are ‘future’,
‘draft’ and ‘pending’.”

Does this mean that drafts considered “public” somehow? These are regular posts, no custom post type stuff here. Or is it tax_query overriding the default behaviour somehow? I’m puzzled.

Here is the code of query parameters:

  $args = array(
    'posts_per_page' => 5,
    //'post_status' => 'publish',
    'tax_query' => array(
      'relation' => 'AND',
      array(
        'taxonomy' => 'height_category',
        'field' => 'slug',
        'terms' => array( $_POST['height'] )
      ),
      array(
        'taxonomy' => 'age_category',
        'field' => 'slug',
        'terms' => array( $_POST['age'] )
      )
    )
  );

The problem is explained in the quote you’ve mentioned:

“Default value is ‘publish’, but if the user is logged in, ‘private’ is added. And if the query is run in an admin context, protected statuses are added too. By default protected statuses are ‘future’, ‘draft’ and ‘pending’.”

Ajax call is always considered to be from an admin context.