They're not supposed to see that tab, it's a UI bug that we fixed in 9.10.1 but if you updated in the first few hours after release you might not have received the patched UI. There will be another release in the next few days to address this.
The end user can't actually see your config, they will see an error. If you can see it it's because you are impersonating from the master organisation which has access to this data.