Since FastAPI 0.89.0 the return type annotation on a path operation function is used as response_model when that argument is not given. FastAPI then validates and serialises the returned object through that model, which means any attribute not declared on it is dropped from the response.
This is the mechanism behind the most common security-relevant surprise in FastAPI: returning an ORM object annotated as a public schema strips the password hash. It is also the cause of a confusing internal server error when the returned object does not fit the annotation, since the validation failure happens after your handler succeeded and is reported as a response validation error rather than a request error.
When the annotation is for the type checker only and should not shape the response, pass response_model=None explicitly. Use response_model_exclude_unset=True to omit fields the caller never set rather than serialising defaults. And be aware that returning a Response object directly bypasses this entire path, so no filtering happens at all.