Funny story: I was playing in a single player world, and my little boy wanted to join me, so I uploaded the world to my Realm, and he logged in.
Then I scolded him for forgetting to switch accounts, as he had all my stuff and all my XP levels... except he hadn't forgotten. I logged in, and I also had all my stuff and all my levels. So we've duped a full set of netherite gear and (as I'd just fought a raid) four totems for good measure!
I was curious, so I uploaded the world again and made sure I logged in first... But still, he gets all my stuff and levels as well as me. It's not supposed to work like that is it?