I have added some custom user options to the profile page on my site, and most are all OK for the user to modify themselves. These options live in their own section. The users have read access and are able to visit the backend and change some settings in their profiles.
There is another per-user option that I do not want the user to ever be able to modify directly. I have the code that creates that option group and section check if the user can edit other users' profiles. If they cannot, the section and the setting are not registered with WordPress (and thus not displayed on the profile page). Only someone with the proper permission can visit to the edit profile page, view, and change the setting via the backend.
Can a malicious user ever submit additional POST data with an otherwise valid profile update and set an option that wasn't registered on the page, but does exist in the database? How certain/solid is this protection? Are there any known problems with it?