I have a custom profile named Marketing Team and the assigned user is Sujal. In that profile, i enabled one visualforce page access to him. So accordingly, Sujal can now access that VF page. I have created VF tab of that page. When i log in to Sujal's id, he is able to access that tab that shows the page output, but when i go to the pages, he is able to view all the pages, though i have given him access to only one page in profile plus he isn't able to delete or clone or edit or preview any of the pages not even the page he has given access to. It's showing insufficient priviledges.
There are separate mechanisms for being able to execute (see the results of) a Visualforce page (see Visualforce Page Security Overview) and being able to edit a Visualforce page (see Viewing and Editing Visualforce Pages). Generally, ordinary end-users of your system would not be given the "Customize Application" permission that allows the editing to be done.