After hiding tab by sending command to ui-control node, I don't see this tab in side menu this is fine.
Also I don't have an access to this tab via sending a command to ui-control node (like {"tab":"tab"}), this is also fine.
hiding tabs is not meant to be a form of access control. There is no protection between tabs - if a user can see one they can in theory see them all if they know here to look.
it is totally hidden - unless they type in the url manually. (or someone provides them a link).
If you really don't want it visible delete it entirely.
In my project I'm using a pin code to allow access to several tabs (settings, calibration etc)... so, I can't delete those pages entirely. I found only way to get it works thru hiding all groups in the tab. So by direct link user got a blank page.