I found another issue with the eztagcloud operator in ezwebin - and I don't know if it is fixed yet (as I couldn't find the svn where it is hosted).

The SELECT (in ezwebin/autoloads/eztagcloud.php, around lines 66 - 90) does not check if the ezcontentobject_attribute.contentobject_id is the same as ezcontentobject.id. Thus an attribute is connected to all objects (that fullfill the constraints for permission checking, same class, tree, ...). (In my situation the tags of some hidden objects are shown again.)

This additional where condition helps:
AND ezcontentobject_attribute.contentobject_id = ezcontentobject.id

Then you can probably even remove the DISTINCT...

Have a nice day

Thomas