Technically all resources including layers have user security (right click Properties from Site explorer on the resource). You can grant access to groups or individuals or retract permissions. If you remove permissions on a layer the map will fail to load. Unintuitively you can remove permissions from the underlying feature source for a layer and when it loads in the map the layer won't display, but the map will load. Unfortunately you would have to have multiple layers in the map to support multiple users and they would all appear in the legend.
Group permissions might be easier to use than individual permissions. However it still probably isn't ideal.
In more advanced instances programmers might build maps on the fly and assign only layers users have rights to.
I'm sure some nice wishlist items could come out of this. For example have groups only load in a map if users have rights to the group. That way you could create different set of layers and only show the desired ones when the map is viewed.
Dave