As of right now (May 2020), you can currently use the mobile version of the Roblox website (NOT the Roblox app) to view small amounts of any users inventory, whether the user has decided to set their inventory to private or not.
Here are two video examples of this bug being reproduced, one on the mobile version of Google Chrome, and the other on the mobile version of Safari. The Phone being used is a IPhone XS Max.
This can obviously been seen as a threat to some developers who want to keep information about their games as disclosed as possible. Even though you can only view 3 items at a given time, a determined user could keep returning to said users profile and then compile a list of assets the user has created as time goes on.