I would expect the following to report an error about incorrect visibility, but gn does seems to ignore the visibility for the config:

config("foo") {
  visibility = [ ":bar" ]
  include_dirs = [ "foo" ]
}

source_set("bar") {
  configs += [ ":foo" ]
}

source_set("baz") {
  configs += [ ":foo" ]
}

$ gn out/xxx
Done. Made 5010 targets from 958 files in 1270ms

Instead I would expect something like the following (that I get when I change "foo" to a source_set and configs to deps):

$  gn gen out/xxx
ERROR at //BUILD.gn:36:1: Dependency not allowed.
source_set("baz") {
^------------------
The item //:baz
can not depend on //:foo
because it is not in //:foo's visibility list: [
  //.:bar
]