Users in The Raiser's Edge who are a member of a security group with no rights to view Constituent Attributes are able to create a Constituent List in NXT and include Attributes (Custom Fields) in the results and view them.
This is working as designed. If a user in NXT has access to view and utilize Lists, they are able to view any fields available with the List. The security setting within The Raiser's Edge database view does not carry over to Lists at this time.
Please add this as a suggestion on our Community page at https://community.blackbaud.com/products/raisersedgenxt
Our developers check here first when considering program enhancements and features to see what our users are most interested in seeing implemented. You can review other ideas and vote for them and of course if your idea is already listed, be sure to add your vote.