When you grant a user (or group) access to an ordered JCR parent node but not to the child nodes, then when the user logs in who has that access the child node ordering under that node is not preserved.
Here's an example demonstrating the issue:
This is due to a bug in Oak JCR repository where the rep:glob ACLs get applied to hidden properties - https://issues.apache.org/jira/browse/OAK-5354.
This is fixed in AEM6.3 and later versions.
However, you can work around this bug in older versions by doing the following: