Why can the default 'import project all' let unauthorized changes into production, and what fixes it?

Because import-project-all imports every transport in the queue/buffer together — regardless of ChaRM document status — so an unauthorized change can slip into production.

Fix: configure status-dependent import (IMG: Specify Transport Request Import Strategy) to control promotion by system role + change-document status.