Hi all,
Quoting the grafana creator, Torkel in his answer on this issue on Grafana repo:
Hiding this in the UI won’t make any difference if a user wants access to the query they can see that in the network and dashboard json model.
All queries are dynamically composed and sent from the browser so the browser always have access to the full query and every user who is part of an organization can issue any possible query for the data sources added to that org.