In the case that you truly control the record type and know it either won’t be subtyped, or you’ll be the one subtyping it, opacity is fine, and does indeed stop composition-breaking shenanigans like this.
But when we add features, we don’t just add them for the cases where they’re useful: we also have to consider the cases where they’re not useful.