We have java code that asks the OS for a list of folders/directories/files - I think your issue is Windows, not SQL Developer.
Also, v18.1 is 2 years old....
I'm not suggesting there is a bug with SQL Developer, just that it wont honour the restrictions implemented.
I am no developer, but I imagine it is something to do with the particular API or functions SQL Develop uses to browse the file system - other applications presumably use a different one that will filter what users can and cannot view.
Is this something Oracle could consider investigating and implementing please?