For what I understand \coursecat::get_all is supposed to check that the user has permissions to see the categories. If 'returnhidden' option is provided permissions are not checked.

It seems to me that

if (!empty($options['returnhidden']) || $category->is_uservisible()) {

should be converted to

if ($category->is_uservisible() && ($options['returnhidden'] || $category->visible)) {

Maybe it is just that I am not interpreting well how the function works or maybe we just need to update 'returnhidden' param docs, but the current returnhidden status is not clear and I can't see any usage of it in core that helps me confirm if it makes sense or not.