Field Level Security not applied to SIP lines as expected | BC20 on prem

Hi!
I am trying to hide Unit Cost fields from Sales users on Posted Sales Invoices.
Although the Effective Security confirms they should not see the fields, they fields are still visible on the page when logged in as this user.
I have tried regenerating the Wrapper .app and installing it, and restarted the local service (BC20 on-prem)
We have many other hidden fields that are working as expected - what am I missing and is there a setup or SQL table I can run in future to verify if field level security is working as expected?
Thanks!
Oliver