This is a long standing issue since ancient versions, however i wasn't able to find any reports regarding this specifically (apart from MC-1297, probably because it's very niche), so i'm reporting this here.

Players are able to hit and interact with mobs through blocks from spawn protection, even though it shouldn't be logically possible. This happens despite the mob being inside or outside the spawn protection area.

The client is able to raycast into mobs behind walls when breaking protected blocks, as they get destroyed client-side for a few milliseconds (might be seconds if latency is high), however the server doesn't account for this and thus validates whatever action the player does to the mob they look at regardless of the blocks between them.

The only case this issue is present in vanilla is within the spawn protection scenario, but this has been largely present in modded servers where plugins cancel placement/destroying blocks in certain areas but allow damaging mobs, althought working around this by applying some other server-side tricks to invalidate cases like this.

TL;DR: The server doesn't check whether the player (client) can actually hit/interact with the entity, validating interactions even if there's blocks between them server-side.

How to reproduce

1. Create a void world in a server with a certain spawn protection radius.
2. Give op permissions to someone else aside from you.
3. Summon an entity such as a villager inside a glass box, while inside spawn protection.
4. Stay outside the box and deop yourself.
5. Try to interact or hit the villager by breaking the glass consecutively (you need to be fast).
6. Notice how the server validates your actions.

Expected result
The server wouldn't let you be able to hit or interact with the entity behind blocks, even if client-side is seemingly possible.

Observed result
The server validates the player actions in this case, making able to interact or even kill mobs behind blocks in protected areas.