Well, it's pretty commonplace for forums to have publicly-visible user lists. Flarum doesn't have a UI for that yet, but the API makes it possible.
That said, there should indeed be a permission so the admin can decide if they want to expose user data. I've made an issue. Thanks for bringing it up!
