As pointed out by @slook in #3496 (comment)
Currently shares are scanned in order: Public, Buddy, Trusted.
This results in (nested) Trusted/Buddy shares being shared as if they were Buddy/Public shares.
Reversing the scanning order should exclude them from shares of lower trust, as the directories would already be scanned.
Additional suggestion: adding Private (or Exclude, or any other term) scanned before Trusted would create an easy way for creating completely private directories, and exempt them from sharing.
I believe this set needs to be reversed:
https://github.com/nicotine-plus/nicotine-plus/blob/master/pynicotine/shares.py#L303-L309
I would be happy if someone more familiar with the code could look into it, in case the behaviour change would require more code changes.