I'm relieved to find that this actually does seem to be 
confusing to lots of people other than me (I'd thought it was 
just me being dense).

Here's my understanding of this:

Private list, no problem. Only subscribers can see anything.

Public list, anybody can look at messages, but all email 
addresses are masked (thus, no harvesting).

If you want to see the addresses you need to acquire a password. 
My understanding was that you need to be a subscriber to do 
this, but I was apparently wrong: really it makes no practical 
difference; the main issue is that the addresses don't sit on 
the open Web, ripe for harvesting.

Thanks to everybody who helped me with this.

-- Russ
St. Thomas University
http://www.StThomasU.ca/~hunt/