Are non-exported packages still accessible from the unnamed module?

Question

I am trying to restrict access to a package in my Java application using module-info.java.

For the sake of simplicity, lets say I have the packages org.test.a, org.test.b and this module-info.class:

module test {
    exports org.test.a;    
}

I then compile that, install the artifact to my local repository and import it in a second project. There, I am still able to access classes of both packages org.test.a and org.test.b, even though only org.test.a should be accessible.

Only when I modularize that project (by adding a module-info.java that requires the test module), I can no longer compile it:

java: package org.test.b is not visible
  (package org.test.b is declared in module test, which does not export it)

Is it not possible to restrict package access to applications that are part of the "unnamed module", or am I just doing something wrong?

I am a bit confused, because even as part of the unnamed module, I am not able to access classes of unexported packages from the jdk (such as jdk.internal.misc.Unsafe).