Views leak
A view runs with its owner's rights, so it sees all rows even when the caller is limited by RLS. security_invoker makes the view check the caller instead.
task
vc is a plain view over customers owned by the superuser, so rep sees every row through it. Recreate it so the policy applies to the caller, then count as rep.