The clue is in the name. A hidden field is hidden but it is there. It can accessed through tab order or by goto object by name. However, if it is excluded from the tab order and has no name it is fairly inaccessible.
The hidden feature is not a security feature but a means of more easily controlling the Ui, so I would be wary to trying to use it as a means of stopping users accessing fields, better to use field level security if that is what you want to achieve.
Nick, I agree with you about accessing a hidden field with a go to object but I disagree with you about being able to tab into a hidden field. If a field is hidden you can not tab into it. The field will be skipped in the tab sequence. Not sure what security has to do with this discussion. I'm not trying to hide a field for security it is an UI issue.
This bug has been confirmed by tech support and sent to the Development and Testing team for further review.