Further, just had a quick look at the db, seems visibility levels are saved in the wp_usermeta field bp_xprofile_visibility_levels. Buddypress reads this field and enforces the policy there, so even though you have changed the site wide policy it still enforces the per user settings (if that makes any sense). What you need to do is update each users policies each time the site wide is changed. The plugin was only ever supposed to be an example on how to do it so I don’t think it is robust enough for a live server.
I just installed this plugin and it does work but it seems that previous policies are remembered so even if you change the site wise privacy policy on a field to “Admin Only” each registered user still has it’s old setting. If you set the field so that the user can change their policy then log in as that user and change it to “Admin only” the policy is correctly enforced. I haven’t had time to delve into the db and see where the setting is saved but I suspect that when the site wise policy on a field is set to be enforced each individual user has to be changed at the same time.
