Adding the part that is easy to miss: the list is not the only thing that identifies who is aboard.
A specific flight is a public object. The airline sells it, the schedule is published, the aircraft is trackable in real time by anyone with a browser, and the departure and arrival are announced. So knowing that a particular flight exists and where it is requires no access to anything.
Which means the interesting question is usually not "who can see the manifest" but "who can connect a name to a booking" — and that is a far larger set of systems than the manifest itself: the booking platform, the travel agency, the corporate travel desk, the loyalty programme, the payment processor. The operational list is one of the better-controlled parts of the chain, not the weakest.