This is working as designed.
If a user in NXT has access to view and utilize Lists, they are able to view any fields available with the List.  The security setting within The Raiser's Edge database view does not carry over to Lists at this time.

Please add this as a suggestion on our Community page at
https://community.blackbaud.com/products/raisersedgenxt

Our developers check here first when considering program enhancements and features to see what our users are most interested in seeing implemented.  You can review other ideas and vote for them and of course if your idea is already listed, be sure to add your vote.