TYPO3 Core

Technically it's because in \TYPO3\CMS\Backend\Utility\BackendUtility:getExcludeFields all "rootLevel" tables (sys_file_reference is one) are ignored.
I'm not sure what the reason is.

How can we find out?

sys_file_reference uses the new security configuration option: ignoreRootLevelRestriction

    /**
     * Whether to ignore restrictions on root-level records.
     * The regular behaviour is that records on the root-level (page-id 0)
     * only can be accessed by admin users.
     *
     * @param string $table Name of the table
     * @return boolean
     */
    static public function isRootLevelRestrictionIgnored($table) {
        return !empty($GLOBALS['TCA'][$table]['ctrl']['security']['ignoreRootLevelRestriction']);
    }

I think the check in \TYPO3\CMS\Backend\Utility\BackendUtility:getExcludeFields must be adjusted to respect this configuration.

This can be closed since its duplicate is merged.