I think we also should limit the count to work packages visible by the current user.
@ulferts Did you intentionally not use the `visible` scope in your example code?

Same applies to MyController, I guess a user can report a work package, is removed from a project and can then no longer see the work package.