Any supervisor of a call queue can effectively listen and barge in on any call for any user in the system. There is no way to prevent a supervisor from adding any extension to a call queue which then gives the supervisor the listen/barge/whisper functions.
There needs to be a way to prevent specific users/groups from being added to a queue, whether that is by group or by adjusting the rights of the Supervisor queue role.