Steps to reproduce:

1. Create template and attach macro {$SECRET_MACRO} to it;
2. Create host and link template to it;
3. Create user with RW permissions to host but with no access to template.
4. Log in with newly created user and see inherited and host macros.

Result:

There is no {$SECRET_MACRO} in the list.