who can see instructions to sitter?

Only the sitter can see your instructions, although I would imagine Rover staff could gain access. But I'd hardly consider that likely.

From a security standpoint, outside individuals, like a sitter, should be given a unique code and then it should be changed/disabled after the job is complete.

Rover admin can access the notes in case of an emergency, but only your sitter can see the instructions once the stay is booked. For something like an alarm code, or garage code, a text might be a better option, that's usually what my clients do.