I did not grant the Can see expense data no matter what right to a user. That user can see expense data on a project nonetheless. Why is this?

The “Can see expense data no matter what” right allows the user to see expense information across all assigned projects regardless of the project level rights granted to the user.

If a user is granted “Expense approval” rights on a project, this also gives the user the ability to see expense data and run expense reports, but strictly on that specific project.