Shared reports restrict the users ability to see only data within the Dept they are responsible for. This is exactly how is should work. However, scheduled reports will send whatever data the creator has access to. This is a security flaw and an administrative nightmare when trying to create reports for a large organization with lots of Departments.
Please update scheduled reports to follow the same protocol as shared even if that means only sending a link to the report vs sending the report as an attachment.
I agree! I was disappointed when I learned that this was the case.