The area_ace of the query is derived from the profile of the creation user of the query.
The new query includes an additional 'where' condition to make sure the query returns only objects where the creation user has access (same area_ace as assigned to the query itself).
The object_ace is created based on the class level ace of the security class for queries.