In database view, a user who does not have access to attributes cannot query on attributes. In NXT, that same user can filter on custom fields. If there is a reason to restrict access to attributes, then the user who is restricted should not be able to filter on those same custom fields in NXT.
Any permissions restricted in database view should be restricted in webview - this is not currently the case.