Limited permissions org users can see ALL other users?

I was surprised to see that a new user I added to my organization with ONLY a permission to "view apps" is able to see all other members in the organization? Is that intentional? Shouldn't that be a permission in itself? (I expected that user to only see themselves i.e. to remove themselves vs seeing all users that aren't relevant to them and potentially revealing identities of other users in the org)