Currently people who are not authorised to view the list of members / users are able to do so. They are not able to enter the member profile however they can still access the list and thus pickup email addresses, or whatever you have chosen to publish in the list. You view should be checking if the users has appropriate access before displaying the list like a specific user profile does.