Hidden menus may be accessed via View User Access
I noticed that users can still be able to access hidden menus via View User Access screen.
I think this issue had existed for a long time, just it is not so obvious before View User Access is added to "Settings and Actions" in 6.4.
It looks like there is something wrong in /usermenu/ViewUserMenu.xsl stylesheet that not able to render USER_MENU_LAYOUT_XML properly (especially hide attribute of <outline> element)
To be safe, I think we should avoid to hide menu links in User Menu Layout, or we should remove View User Access (glog.webserver.useraccess.ViewUserAccessServlet) from