You guessed it, it’s hidden for new users so someone can’t create a new account and fill in a URL or other information to create spam.
Regardless, all profiles at all levels get a X-Robots-Tag: noindex header, so they’re never linked by search engines anyway. Posting spam to user profiles on Discourse is a big waste of time.