SecurityInterceptor sits outer-most in the default configuration and catches any exception coming from inner interceptors. When it catches an exception, it closes the call with UNAUTHENTICATED.
If other interceptors try to close the call early (i.e. in interceptCall, like SecurityInterceptor does per default), they will close the call and throw a StatusRuntimeException. SecurityInterceptor will catch the exception and try to close the call once again with status UNAUTHENTICATED.
From my point of view, the expected behaviour is that SecurityInterceptor does not interfere with exceptions from inner interceptors. They will usually not indicate an authentication problem.