On Hosts -> Review template page, its possible for user to see the rendered template - even that the user doesn't have the view_provisioning_templates permission.

As rendered template may contain passwords or other data which should be protected, it should not be possible to see the rendered template without having the view_provisioning_templates right.