Actually that is how Azure DevOps works AFAIK. Work item IDs are unique within an organization irrelevant of projects. DevOps supports querying across projects in queries.
Within the web portal you can limit visibility based upon user groups set up at the project level. However as documented in the APIs this is not enforced at the API level. Therefore if you have read permissions to an organization you can query for work items irrelevant of what project created them. Same thing with write privileges. Hence the project part of the URL is for resources that need it and consistency but does not necessarily have any impact on what is and isn't visible at the project level. It would depend on the individual resources whether the project has an impact. For example querying for a project's dashboard would care about the project but accessing work items (that are shared across all projects) doesn't particularly care provided it is a valid project in the organization.