Allow the default user fields for the profile to have permission sets. For example, a common tactic for spammers is to place links in their About Me section and Homepage. Our resolution to this was to create a custom user group require 5-10 posts before these fields could be filled out, and then issuing a usergroup promotion. It does not appear possible in XenForo without directly editing the templates. Another solution would simply to be to allow you to set the minimum requirements for a user field, custom or not, to ever be displayed, despite the user's privacy settings.