If you have 'userewrite' enabled you can bypass any ACL restrictions by adding '?do=yyy' to the end of the URL, where yyy can be anything.
Example:
http://www.example.com/dokuwiki/restricted:personal?do=yyy
If the above example was a real site, and that page was restricted, it would be viewable by anyone just by that simple addition to the end.
If 'userewrite' is disabled, as is the default, it does not appear to be an issue.