Why is authorization required in non-wrapped routes?

Question

Laravel

<?php

Route::get('front', '[email protected]');
Route::post('front','[email protected]');
Route::get('/', function ()
{
    return view('welcome');
});
Route::group(['middleware' => ['web']], function ()
{
  Route::auth();
  Route::group(['middleware' => ['auth'] ], function ()
  {
           ....
        }
       ...

I have authorization, and routes available to authorized users, and routes available only to the administrator
With the separation of routes, visible after authorization, there are no problems, but for some reason the routes that are not wrapped under the middleware (the first 2 routes in the provided code still fall under 'auth')
what could be the problem? where else can auth be called so that it captures the entire routes file?