I thought it would be much better to not show the stock block at all if the user does not have appropriate access. Drupal makes this easy: just return an empty array for the block. Here's the new stock_block function that accomplishes it with the change in bold:

function stock_block($op = 'list', $delta = 0) {
  $title = variable_get("stock_block_title", "stocks");

  switch ($op) {
    case 'list':
      $block[0]['info'] = t($title);
      break;

    case 'view':
      switch ($delta) {
        case 0:
          <b>if (user_access('use stock')) {
            $block['subject'] = t($title);
            $block['content'] = stock_contents( 'block' );
          }</b>
          break;
        }
      break;
    }
    return $block;
}