A referenced script is accessible by all users that pass the activation record test. As long as the system can  access the JavaScript code, so can the users on whose behalf the system fetches the code.

This is also true in case the JavaScript is an attachment of a Confluence Page. Even if a user has no access to that page, the attached JavaScript code will still be delivered if the script is activated.