Which setting on a profile makes a tab hidden in the App Launcher, but still allows a user to view records that would normally be found under these tab?

Object Permissions control CRUD access to records, not the visibility of tabs in the user interface.

The 'Tab Settings' within a profile allow an administrator to set a tab's visibility to 'Tab Hidden', which removes it from the App Launcher and navigation bars but does not revoke access to the underlying object records if object permissions are granted.

App Permissions control access to various application-specific functionalities and settings, not the visibility of individual tabs.

Org-wide Defaults define the baseline record access for all users, but do not directly control tab visibility or prevent users from seeing records if they have other access.