Can someone with access to only a workspace see data in other workspaces?
No, they will only be able to access data that's associated with that workspace. If there are only 100 profiles in a workspace, but 500 in the organization, the person who only has access to that workspace will only ever be able to see the profiles of those 100 people. Further, if that workspaces profile only has 5 custom fields associated with it, the workspace user will only see data for those 5 custom fields.
What if they’re tech-savvy and use an API or something?
No, they can’t see it even then.