The issue we have encountered with the Hidden Form Behaviour is the columns are still accessible if the user uses the Web Inspector tool that's built into every browser. Whilst this is unlikely it is very easy to do. You can also in theory run a script in the browser to show the hidden columns.
Generally this isn't an issue as you store the sensitive data in a separate table which has restricted access but there are examples where the sensitive data does need to be used in other areas and the use of Form Behaviour provides an option.
The suggestion is that hidden columns are either masked or hidden on the server side so the values are not passed to the client.
