A client account, contact record, and login each serve a different purpose in access control.
The person must have active organization access and an appropriate client role. Limited access then depends on the contact's case relationships or explicit assignments. Role permissions determine allowed actions, and access groups can restrict particular updates and attachments.
Two contacts belong to the same account. One is the contact on Case A and the other on Case B. Their limited client logins do not automatically give both people all account cases. Review each person's assignments when deciding which work they should see.
A case being visible does not mean its internal notes, financial details, and attachments are all visible. Review the specific rule instead of widening the person's access unnecessarily.