The query will only filter out those that have specifically set Profile Privacy to Private. If they're using any other privacy rule it won't filter them out. So it depends on what privacy rules your users are using as to how well it'll help. At any rate the only way to really fix this is for CB Privacy to extend the userlist query when possible.