Adding an resource/contact (affectation) to a Project

A resource has to exist at the top level of a project.

No, it is not mandatory.

For a project at a lower level it would be easier to only allow selection of the resource from a list that has been entered into the top level.

No, because a reousouce can be affected to a sub-project without having visibility to the top one.

Currently it is confusing as the resource cannot see their activities etc until that has been completed.

Resources can only see activities of the projects they are assigned to, and their sub-projects : it is the basis of the security restriction in Project'Or RIA.

Example :

Project 1
=> Project 2
=> Project 3
=> => Project 4
Project 5

Resource A affected to Project 1 sees all data of projets 1, 2, 3 and 4 but none of Project 5
Resource B affected to Project 3 sees all data of projets 3 and 4. that's all. Resource B is not even aware that project 3 is a sub-project of project 1.

Unless I put the Resource A into Project 1 then the Resource A cannot see their activities in Project 2.

Or you can affect resource A to project 2.
This a basis security constraint.
Resources cannot see activities of project they are not affected to.

Please make the selection of resources only available if they are in the project above and not all resources in the entire system.

No, this is not possible.
It mist be possible to affect Resource A to project 2 without needing to affect it to Project 1.
This also is basis security constraint.
Exemple :
Project 1 = Bad Projects
Project 1.1
Project 2 = Good Projects
Project 2.1
If I affect resources to Project 1.1 or 2.1, I just don't want them to know in wich Top project the project they work on is.

In Project 2 I selected Resource B from the entire set of resources but did not add Resource B to Project 1. Resource B could not access their activities.

I'm sure they can. Try disconnect / reconnect to retrieve correct access rights.

It is not possible : it must be possible to affect resources that are not affected to top project.
It is a basis in Project'Or RIA.
Many users use this functionality to manage access rights (I do !), so I can't won't change it !