While not 100% sure this is a bug, I assume it is based on the permission toggle.

On the left hand menu next to the Themes, Activities and Thank you sits what appears to be a "View all members" button with the same power as the one the permission seems to be intended to give. Meaning anyone can view all members regardless of that permission setting.