Realized we have no condition for checking entity access yet. Let's add this - similar to #1722460: Entity field access controlled by Rules.