Affects xbox one and switch
If a player on xbox/switch is playing on a realm, they can simply connect another controller, and then have the second player immediately join the realm player one is on..

Player two does not need to be white-listed for this to happen, there is no way to stop this, and you cannot tell who is piggy backing in the new, none white-listed player.. This is a massive security issue for realms that use a white-listing system (so every realm worth playing on). You could have one person piggy back in another account, and just grief with that account, while no one suspects a thing from the main account.

The only real way to prevent this, is ban all players that use xbox/switch :/

Below you can see a clip of Barrett (white-listed on my fan realm) piggy back in Tankless (never been white-listed). Again, unless the player piggy backing in another person records what they are doing, there is literally no way to tell that its them.

A small note, you can see when tankless joins, it has the normal village panorama, instead of the nether portal it usually shows when joining realms. I think this may be related to MCPE-47731 in the way that bedrock doesn't think you are joining a realm, only a multiplayer world.