In database view, a user who does not have access to attributes cannot query on attributes. In NXT, that same user can filter on custom fields.  If there is a reason to restrict access to attributes, then the user who is restricted should not be able to filter on those same custom fields in NXT.