The integration of AAA and RFC8040 RESTconf is broken - auth is not required to access RESTconf API anymore(expectation - at least basic auth should be on by default). It seems like the root cause was the following change-set:
https://git.opendaylight.org/gerrit/c/netconf/+/89419