restrict profile field to module and admin in drupal 6
Yep, you got it right.

Inside the profile.module's profile_view_profile() function, it uses the following logic when modifying $user to include the additional fields for viewing...

// Show private fields to administrators and people viewing their own account.
if (user_access('administer users') || $GLOBALS['user']-&gt;uid == $user-&gt;uid) {
  $result = db_query('SELECT * FROM {profile_fields} WHERE visibility != %d ORDER BY category, weight', PROFILE_HIDDEN);
}
else {
  $result = db_query('SELECT * FROM {profile_fields} WHERE visibility != %d AND visibility != %d ORDER BY category, weight', PROFILE_PRIVATE, PROFILE_HIDDEN);
}


...so yes, settings fields to PROFILE_HIDDEN will show them only to users with the administer users permission and/or to the user who is viewing his/her own account.

When editing a user, the module calls upon the _profile_get_fields() function to present the fields to be edited on the resulting form, and there, it uses the logic...

if (!user_access('administer users')) {
  $filters[] = 'visibility != %d';
  $args[] = PROFILE_HIDDEN;
}


...to restrict the editing of these fields to just users with the administer users permission by filtering out those fields from users without that permission.

And, of course, if your module or theme wants to edit anything in the database directly, there is nothing to really stop it.