You should never send to the user any data that they are not allowed read, independent from the fact whether the data is actually displayed on their screen. I assume that your data comes from a server (which possibly reads it from a DB); even with Angular.js you need to make sure that your server will only send the data that particular user is authorized to see.
So the answers to your questions are actually not related to Angular at all, but to the server-side technology you use to feed the data to the angular client running in the user’s browser.
solved Is it safe to use AngularJS? [closed]