They don't. It just shows that on the Who's Online screen because it doesn't check whether the user has permission to see it or not (in other words, to update the who's online display to leave a note saying the person is seeing the no permission screen would probably add another query for every user displayed)
