RLS USERNAME() in Embedded is being cached, breaking RLS
I'd advise caution with that React rewrite.
Sounds similar to what we experienced - we were using phased rendering .load() and .render() methods (https://docs.microsoft.com/en-us/javascript/api/overview/powerbi/phased-embedding). We noticed we weren't able to reproduce the bug in our app either if we switched to .embed(). In a tiny hand-crafted reproduction project we built, we were also able to consistently leak sessions across users with phased embedding .load() and .render(), but weren't able to reproduce a leak at all if we used .embed().
We built a patch with .embed() and shipped it to our customers, but out of abundance of caution, we also introduced a failsafe mechanism that constantly verified if the reports we were about to display had the expected user id (CUSTOMDATA() in our case). That failsafe triggered about 4h after release, aborting the render and pulling our production down again.
So moral of the story - even if it seems your React rewrite helps, it may just be making the problem less frequent.
And regarding the Playground repro:
We also weren't able to reproduce the problem in the Playground. We did manage to reproduce it very consistently in a fully synthetic repro project though (with zero dependency on any of our existing infrastructure and just a handful of visuals, manually typed in tables, and like 40 lines of javascript).