I have a very simplistic example of a shell module, with following code.

<?xml version="1.0" encoding="utf-8" ?>
<!-- src/Foundation/modules/_protected/BasicComponent/module.config -->
<module loadFromBin="false" tags="EPiServerModulePackage">
    <dojo>
        <paths>
            <add name="addon" path="ClientResources" />
        </paths>
    </dojo>
    <clientModule>
        <moduleDependencies>
            <add dependency="Shell"/>
            <add dependency="Cms" type="RunAfter"/>
        </moduleDependencies>
    </clientModule>
</module>

// src/Foundation/modules/_protected/BasicComponent/ClientResources/MainWidget.js
define([
        "dojo/_base/declare",
        "dijit/_Widget",
        "dijit/_TemplatedMixin"
    ],
    function (
        declare,
        _Widget,
        _TemplatedMixin
    ) {

        return declare([_Widget, _TemplatedMixin], {

            templateString: "<div>Lorem ipsum dolor sit amet.</div>"
        });
    });

[Component]
public sealed class BasicComponent : ComponentDefinitionBase
{
    public BasicComponent()
        : base("addon/MainWidget")
    {
        Categories = new[] { "content" };
        Title = "Basic Component";
        Description = "";
        AllowedRoles.Add("Editor");
        AllowedRoles.Add("CmsAdmins");
        AllowedRoles.Add("CmsEditors");
    }
}

"CmsUI": {
  "ProtectedModule": {
    "Items": [
      {
        "Name": "BasicComponent"
      }
    ]
  }
}

Having it defined as a protected module works correctly, and it's loaded from following URL:

https://localhost:5001/EPiServer/BasicComponent/ClientResources/MainWidget.js

However if I move the module to the public space (e.g. directly in /modules/ , not in /modules/_protected) and remove the declaration in appsettings.json, the AutoDiscovery should register the module in the same way, but CMS tires to load it from non-existing URL:

https://localhost:5001/EPiServer/Shell/12.3.2/ClientResources/addon/MainWidget.js

Only if I change public modules auto discovery level to minimal and explicitly add module,

"CmsUI": {
  "PublicModule": {
    "AutoDiscovery": "Minimal",
    "Items": [
      {
        "Name": "BasicComponent"
      }
    ]
  }
}

then it's loaded correctly from URL:

https://localhost:5001/modules/BasicComponent/ClientResources/MainWidget.js

Following documentation at https://world.optimizely.com/documentation/developer-guides/CMS/user-interface/configuring-shell-modules/ module should be correctly registered, without need for additional confiuguration.
Is the something I am missing or is this a bug?