On the Security Overview page, it is stated that:

if the link points to a page in a space to which the visitor does not have 'View' space permission, the link will not be rendered at all.

The above statement could be misleading since the actual output looks like a broken link (text within square braces, red background) despite the "link will not be rendered at all".