This has nothing to do with the theme but all with security. Widget can't read the attributes due to security reasons. Did you switch security on? Click on Project: security, tick production.
If you inspect the access rules of system.user you will notice that there aren't any read/write rights set for these attributes. As the system module isn't editable you won't be able to access these attributes directly.
What worked for me in the past is using conditional visibility on the blocked attribute and showing something else indicating the blocked status.
Maybe you can use a virtual attribute to expose last login.