Sveltekit layouts are not safe for the auth purposes. Load functions in nested components can be accessed in nested children even if you're not authed. In order to fix that, you should use await parent() in each load function.
It may be a good idea to use hooks for that purpose.