VSTS - Publish extension to private collection for

This question already has an answer here:

How to test new Azure DevOps extension version before publishing it for everyone 1 answer

I created some VSTS extension for internal use. I also created a CI/CD pipeline for these using the "CI/CD Tools for VSTS Extensions" by MS DevLabs. My approach has been to first push the extensions to a private testing VSTS collection and then once I have verified them I share them with my "prod" collections. I noticed yesterday though that my changes were immediately visible in my prod collections so I need to correct that.

Release Pipeline is as follows:

Test environment does a Publish Extension, Share Extension, and Install Extension.

Publish: I have "Extension visibility" set to Private and "Share with" is set to my test collection.
Share: "Share with" is set to my test collection.
Install: "Install in" is set to my test collection

Prod environment does a Share and Install. Those push out to my prod collections. I have a Pre-deployment authorization set up so I can release to the prod environment after verifying Test. I haven't approved any changes yet so I do not expect my changes in the prod collection.

Why are my extension publishes immediately visible in my prod collections after only executing against the test environment? Is it because once I publish any collection that has installed my extension has visibility to new functionality? Do I need to set the visibility to private preview in my publish step?

If so does that mean I need to add a publish in my "prod" environment to change my extension from private preview to private? I have concerns I'll need to move the versioning step out of the build and into the release in that case. I'm assuming I can't publish the extension again without changing the version. Is that Share step necessary in test environment since share is part of the publish?

We do versioning only once in the build. Each build increases the version number. These versions are then deployed. This could mean that your Public extension skips some versions since those are only deployed to the test environments. The build produces a VSIX.

We use two publisher accounts in the marketplace: alm-rangers and msdevlabs. The ALM Rangers one is used for all our private testing. msdevlabs is the public account that you find in the marketplace.

Each of our release environments has only one single task: Publish Extension. For our canary environment, we publish the extension as private. For msdevlabs as public.

Here are some screenshots: