Core answer
Start here. This is the direct spoken answer to practice first.
Overview
Object-level permissions are one authorization hook, not a complete data-visibility system.
DRF generic views check object permissions when get_object() retrieves one instance. They do not run an object check for every row in a list, so the queryset must already limit which objects the caller can see. Creation also does not retrieve an existing object through get_object(), so create authorization belongs in view-level permission logic, serializer policy, or perform_create() and the application workflow.