Reviewing through your inquiry you might find the Moderation: Frequently Asked Questions and Who Moderates What? sections of the documentation helpful. However to answer your specific questions, please see below:
1. Is this working as expected?
Hidden content should not be moderated, however it's possible these users are creating the content in the root container. If so, you are seeing the expected behavior. If this is specific to hidden content, it's possible your instance has been customized to add in this feature, however I would recommend submitting a case in your secret customer group for additional investigation.
2. What is the function / idea behind?
As content in the root container can be viewed by all users of the instance. If moderation is enabled, content posted into that container would follow the same logic as moderation of any container.
3. Can that be prevented?
Yes, by disabling moderation in your instance (and only enabling it in specific spaces) you should no longer see content form the root space appear in your moderation queue.