if the user has "View profile" access then yes all profile data - including attributes from your object XYZ should be visible to the user there is any data ingested in the hidden object.
If your goal it to block user access, you should apply ABAC and Governance Label to enforce field level access restriction.