Background
This was implemented to address Views not checking entity access on query or render time, which could result in views exposing data from entities that should be entirely inaccessible. The overall need for this change was masked by the fact that it was not an issue for node entities, as they have a query access API.
The need to make this change was surfaced by this issue: #3063216: Inaccessible Media entities still have rows generated for them in the Media Library view, containing form wrapper markup *and* the media label, where the titles of media entities that should be fully inaccessible could be found in the markup of Media Library views. It became apparent that this compromised access restriction could occur with any non-node entity displayed by views.
Solution
Views now adds a ENTITY_TYPE_ID_access query tag to all its queries by default. This means that any implementations of hook_query_TAG_alter(), where TAG is of the pattern ENTITY_TYPE_ID_access -- for example, user_access if user accounts are being queried -- will now run on Views queries as well.
How this could potentially impact custom/contrib modules
If a module does not implement hook_query_TAG_alter() where ENTITY_TYPE_ID_access is the TAG (example: hook_query_user_access_alter(), then this change has no impact on the module. For modules that do, these hooks will now be invoked anytime Views queries entities of type ENTITY_TYPE.
These are invocations that were not occurring by default prior to 8.8.0, so module developers should review their usages of hook_query_TAG_alter() where TAG is ENTITY_TYPE_ID_access, and confirm that views displaying entities of a given type are not adversely impacted.
