During the workflow setup and Form User Assignments a user can not be assigned to a form/entity combination if they do not have access to it. If after the workflow is setup the user has their security adjusted then the user will still see the workflow task but will not be able to see any data associated with that form. This will apply to historical returns also.