In earlier releases all attributes were visible to users. This made sense in some use cases but this quickly became a general security concern where only privileged users should be able to see the majority of the attributes. In the first iteration of this feature, RSA chose the attributes that were shown for user objects. While this solved the security concern, there were several customer use cases that were not met by this functionality.
With a focus on helping organizations achieve business agility by limiting who can see what attributes – we are proud to 
For example, if I am a reviewer for an application, I may be able to see who has access to my application. While it is important to have some details about the user to decide if the access should be maintained or revoked, it does not make sense for me to see all attributes about the user. The user object may include some more sensitive attributes that administrators have decided to keep private. By default, a very minimal set of user attributes are marked as public.
