Yes, you can see it, which you shouldn't. There's no need to block users from viewing the content, but then following users and their profiles, etc, if it's intentional then it's not a bug, but then please move it as a suggestion - requesting a permission to 'can view currently active users: yes/no'.
I can NOT imagine a reason why you want a private community but permit users to view who's on the community, what they are doing, what their stats are and what threads are created / being read, etc .
The online list shouldn't leak any information that they can't see (ie, it's not going to leak a thread title they can't see, but it will say they're viewing a thread). I'll defer to the linked suggestion.