SQL filter applies when a find is send to the direct DD. So if you have a orderheader --> customer situations then the SQL filter of the customer does not apply when you send a find to orderheader and vice versa. Since most finds in a structure is to the main_DD, that SQL filter will be used most, but if you would do a manual find - say in a button - to a DD in the structure that is not the main DD, that SQL filter would be applied.

You could store the result of your function in a web property, so that you have to call it less frequently. You will indeed need to figure out an event when the result of the function would change. OnChangeRights might just work although it feels a bit too global.