You have created a scope to limit a user's ability to see certain functions, in this case to limit the user to only see the KSDU (Software Deployment) module.
The user is indeed limited to see Software Deployment only, however, the user is able to see all the profiles.
This is by design. In order to manage machines, add/remove profiles from machines, you need to be able to see all the profiles. If you were unable to see the profiles, you would be unable to add new ones.
RESOLUTION / WORKAROUND
There is no way to avoid this. Profiles are not user specific, they are system specific, so any user with access to the profiles page can see all the profiles.