I meant to blog about this for a while now but Willy just beat me to it. We had a discussion about this this morning and he did a great entry check it out Team Foundation Server - Why can all valid users see all Team Projects?
Thanks Willy.
Cheers,
ET