Did I missed something ?
Any user define into security database can access at any database on the server
and can create object in the database

Can't we have a CONNECT and CREATE OBJECT privileges to avoid this ?