EntityQuery and entity access control handler default enforcement in Drupal 8-11

Drupal core's EntityQuery service returns entity IDs without applying view access checks by default. The goal is to clarify where responsibility for access enforcement sits when EntityQuery interacts with the entity access control handler across Drupal 8 through 11.

The uncertainty is whether omitting accessCheck reliably exposes entity IDs for entities the current user cannot view, and whether access results remain stable between query execution and subsequent entity load. Behavior depends on the entity type's access control handler and any contributed access modules altering grants.

Does EntityQuery enforce view permissions by default in Drupal 8 through 11? What conditions cause access check results to diverge between query execution and entity load?