I've found that Assigning content (Assign To) to students still allows those via Public and Institutional Visibility (Course Visibility) to see content. In my testing, this happens with Module visibility as well as Content in a module.

I'm wondering if this is intended or not as this allows students outside of the course to see content hidden from students enrolled in the course.

The article doesn't share any light on this.

Canvas Course Visibility Options - Instructure Community - 387053