Hey there.
This is intentional, to prevent the enumeration of private projects (somebody being able to guess that project key foo exists because a 403 is returned rather than a 404).
This is, from my perspective, really expected on most services today. You’ll find the same if you try and browse one of my private repos on GitHub (https://github.com/colin-sonarsource/test-github-app-renamed).