Why are the lookup, message, and data security changes appearing in my sandbox even though I haven't yet refreshed my sandbox?

Lookups, messages, and data security records are values stored in tables. These records aren't copied to your sandbox until you make changes in these artifacts in your sandbox.

But what if another user changes these artifacts in a different sandbox and publishes it before you make changes in your sandbox? In that case, the other user's changes show up in your sandbox as soon as you make changes to these artifacts, even before you refresh your sandbox.