We're not the developer of Components Anywhere. It simply displays a component view as I understand it. So if you're displaying a users profile and viewing user would normally have access to it then it'll probably display it fine. If it shouldn't then you'll need to take that up with Components Anywhere. It should not be ran on any user input content, which Custom HTML fields are not user input so it's fine.