I've created an asset source: 'restricted uploads' and a user: 'Jim', who is a member of the 'staff' User Group.
Neither 'Jim' or the 'staff' group have any privileges for the 'restricted uploads' source.
If Jim logs into the admin panel and goes to 'Assets' in the sidebar, he can't see the "restricted uploads" source (as expected).
However, if Jim opens a file selection modal which includes access to the "restricted upload" source he can see "restricted uploads" listed in the modal source sidebar, and can select files from that folder.
Shouldn't Jim's missing asset "View source" privilege prevent him from being able to see the files in the "restricted upload" folder?