The module attempts to obey content_translation_translate_access() but it does not

I'm also wondering if this is a feature :) Like allows a user to translate an entity if they have edit access but doesn't give them access to the rest of the translation UI. Maybe we need a new permission that is allows people to use the inline translation stuff even without the normal content translation permissions. This opens a can of worms around naming though....

"Use inline translation form even when you don't have the usual translation permissions" is a horrible permission name :D

The alternative is to completely remove the check and add documentation that because this makes translation inline we don't check the regular content translation permissions and only access to the edit form is needed.

We need to address this prior to any stable release so raising this to critical.

I think this is the best approach - a user can remove the permission from any roles they don't want after update and the permission does not affect whether user get's access to edit an entity so nothing is changed for existing sites.