There is no check for mod/scorm:viewscores called when looking at the page: your_url/mod/scorm/view.php?id=##

when the capability mod/scorm:viewscores is set to prohibit or prevent there is no check to ensure that the score should be displayed.

view.php calls - scorm_view_display() from locallib.php

locallib.php has the following:

$result = scorm_get_toc($user,$scorm,'structlist',$orgidentifier);
...
echo $result->toc;

scorm_get_toc() is called from the corresponding version of scorm in mod/scorm/datamodels/

somewhere before $result is passed back should be a check to see:
if (has_capability('mod/scorm:viewscores', $context))

or once it is passed back $result->sco could be cleared out if the capability is not allowed