In general, Router.php handles these cases, but only when the tree parameter is explicitly mandatory, which isn't the case for module routes.
Therefore, the respective check and redirect has to be made either by the module itself, or we'll have to define special module routes with mandatory tree parameters (we had discussed this a while ago in a different context here), which would solve this as a side effect.
For private trees, the list urls result in errors when the user is logged out, e.g. when using /webtrees/module/source_list/List/tree1:
In general, Router.php handles these cases, but only when the tree parameter is explicitly mandatory, which isn't the case for module routes.
Therefore, the respective check and redirect has to be made either by the module itself, or we'll have to define special module routes with mandatory tree parameters (we had discussed this a while ago in a different context here), which would solve this as a side effect.