I don't agree because the topic id is not private information.  In fact in the live application the topics are SIC codes so the SIC code is actually displayed on the web page!

If the page worked the other way around and we had a single topic and had to check boxes to indicate contacts to whom it applied then yes, it wouldn't be a good idea.

Where possible we use NT security and any user can only see their own records.  Any pages that allow admin functionality that would allow other users to be viewed is not published to the live server, but stay safely on the staging server, which cannot be accessed externally.