GJ is completely secured. The access permissions are checked before anything is ever displayed to a user. A Google bot which indexes the site for example will be viewing the site as a Guest and if the group for example is set to Registered then Google will never know the page even existed.
You could set the entire GJ plugin to be Registered and non-registered users (including search bots) would never know it was even installed for example. Being a professional user I recommend simply installing on a test site and exploring its access permissions for your self as you can control basically access to everything.
It's also worth noting there are 3 types of groups Open, Approval, Invite. Open any user can join. Approval requires group owner, admin, or moderator approval, and Invite requires a user to be invited to the group. Invite groups will not show to anyone regardless of access (site moderators and category owners are exempt) unless they've been invited to join or are already a user of that group.