$fillable describes which fields can be mass assigned(via fill() method for example) while $guarded sets which fields can not be mass assigned so when you fill() with properties that are guarded they won't get saved in database. $hidden are fields that won't be shown when serializing model to JSON or array.
Regarding your questions - password, user_role, user_points $guarded - hidden does not mean guarded so if field is hidden and fillable it can obviously be fillable