I have the exact same problem. I have tested on a basic install with only 1 post with id 1 and this string /wp-json/posts?filter[post__in][]=2
still returns that post, which it shouldn’t AFAIK.
Is this something that is fixed in the version not yet pushed to the wordpress repo?