In Closed Group (guess that in Secret also) anyone can see Members List, even if anyone is not the Group's member'.
It have to be restricted by default in Closed and Secret Group and Event.
The same thing in Events (closed and secret, as well)
NB It is very good idea to make in Group/Events page checkbox "Show members list to..." like in D7 now. But I definitely not asking to push this issue to UNA 10 Milestone. The problem needs to be solved by simple closing members list in this RC, and in the future - it'll be nice to have D7 choosing options (for members list, comments, group Jot-chat etc)