Only the following people can see the list of members if a project is
confidential: the manager(s) of the project, site admins, and the org
admin(s) of the org(s) the project belongs to, if any. Everyone else,
including people who are themselves members of the project, cannot see
its membership.

GQL query will return an empty users list if you're not allowed to see
the project members.

As suggested by C# builtin code analyzer.

For project members, and ONLY for project members, we will default to
showing them for projects whose confidentiality has not been set. This
isn't the most secure default, but it will avoid what would likely be a
lot of user confusion.