When this privacy setting is set to “No one”, absolutely no one should be able to follow you into experiences, or see what experience you’re currently in.
However, it’s somewhat possible to bypass this. This method is not as severe as it requires you to be friends with the person, and it only tells you the name of the experience they’re in (not the place ID).
Due to the nature of this report, reproduction steps and other details will be disclosed in the private message for staff only.
For anyone curious, this bug happened in the phone book API: SocialService:PromptPhoneBook()
Opening the phone book for the first time in a play session would display the name of the experience that your friend is in, just for a split second before disappearing.