I don't know that I ever really paid that much attention to whether the proxies accordion appeared on a user record, but it makes sense, to me, that they would be visible, since the permission to "view" proxies is required to perform check out. I guess we could ask them to put an explicit check for the "Users: can view proxy relationships" permission in the UI for the accordion (I believe it currently checks for the sub-permission "proxiesfor.collection.get", which is a sub-permission of "Check out: All permissions", on top of the "Users: Can view  user profile" permission). If a user only has permissions to view the user profile, but not check out items, then they shouldn't see the proxies.