If a user does not have access to a column there is currently an inconsistent response for complex column types.
create table default.t1 (
where user has column-level privileges on 'c3', but not on 'c5'
select 1 from t1.c5.z returns a PrivilegeException on t1.c5.
select 1 from t1.c5.m1 returns a PrivilegeException on t1.