How can I ensure a user field is hidden by default for the logged in user?
If you don't want to depend from a module implemented by others, you can implement hook_field_access() in your own module. It is quite easy to change the access permission for an entity field, knowing its name.

function mymodule_field_access($op, $field, $entity_type, $entity, $account) {
  if ($field['field_name'] == 'field_of_interest' &amp;&amp; $op == 'edit') {
    return user_access('edit field of interest', $account);
  }
  return TRUE;
}


$op is 'edit', or view'; $entity contains the object for the entity to which the field is attached; $entity_type is the entity type.

With a module that aims the specific fields for which you want to control the access, it is easy to enable the access control: Just enable the module when you need it, and disable it when the access control is not necessary.