Privacy controls are exempt for moderators. Meaning moderators can see private fields/tabs. Ensure "Moderator View Access Level" is set correctly within CB > Configuration > Moderation. If it's set to Public for example then everyone is basically a moderator and can cause issues like that.

What are your privacy settings on your custom HTML field? It sounds like its privacy settings aren't configured properly and the profile or tab privacy settings were what was keeping it hidden. Typically to force it private you'd use the below.

Integrations > CB Privacy
Display: Forced privacy control
Default: Private

However in forced situations like this it's typically better to just let CB Conditional handle it. The below would work.

Integrations > CB Conditional
Display: Field conditional show
Field: Users
User: Viewing User
Operator: Is
Value: [user_id]

That should cause it to only be visible if the viewing user is the displayed user.

Ensure CB Privacy in CB > Plugin Management is set to Public so it loads. I'm not seeing any issues with forced privacy controls being subverted for Custom HTML fields. Is the field actually rendered on the About tab or is it being substituted into the About tab?

I don't recommend ever setting plugins to anything but Public. That completely controls where a plugin loads or not. That will also be completely gone in CB 3.x as it causes so many loading issues. Same for publish/unpublished plugins. Rather than unpublish simply uninstall would be the best option.