With advanced security, a person can still see a journal entry with detailed information on an account that they have been restricted access to, the only thing masked is the account number.  The amount and journal reference still show, and in payroll entries this is confidential information.  Who cares if the account number is masked?  That doesn't mean anything, it's the information being posted to the account that is confidential.