This morning I noticed that there was an instance I could not join, I was receiving the "you are not allowed to travel to that location" error.
My kneejerk reaction was to assume that I was banned from the group for some reason, but upon further investigation I found that I am still in the group so that was especially strange.
As it turns out, the instance does not appear in the Group Activity feed, it only appears in the friends wing.
I then decided to test with my own group by creating a role-locked instance and asking a normal member if they can see it, and sure enough, same scenario - not appearing in the Group Activity feed, but they can see where I am in the friends list, just unable to join it.
So yeah, role-locked group instance visibility is currently broken and needs a bugfix. In the meantime group members may see role-locked instances that they're not supposed to.
Thanks.