So it turns out there is a problem with Teams Guest access: the security policies are applied from the host, not the source.