That is correct. Unless your address is "protected" a large number of companies with access to CPR can look up your address. No privacy to speak of there.
Yes, the Danish social security card contains the CPR number (SSN).
A big (huge) problem in Denmark has been created as an unintended consequence about fear of "having a number assigned" to you. As a result of much debate in the 1960-70's, the compromise was to designate the CPR number as "confidential". Which was really, really stupid in the first case because 6 digits out of 10 is your birth date, one is a check digit, so in reality you have very, very limited entropy.
But worse, because many confused confidential with secret, misguided companies (and authorities) started using it as an authentication method. The logic being that since 3rd parties were not supposed to know the "secret", proving this knowledge was taken as proof that you were who you claimed to be.
Even today, it is amazing what you are allowed to do with a CPR number. So yes, it is foobar.
Also a Danish social security card (the kind you show to doctors or hospitals, so you take it everywhere) contains your full address and the CPR number. Handy if someone finds your wallet, so they can bring it back. Unless of course they want to screw you over, because all relevant personal info is on that single card.
If you find a Dane's wallet, you can basically do any kind of business on their behalf that doesn't require showing a picture ID.