Users need 'administer permissions' to edit roles on the user edit page

If a user has permission administer users but not administer permissions, they cannot edit user roles on user/UID.

Seems like they can. The core AccountForm does contain the following code:

$form['account']['roles'] = [
  '#type' => 'checkboxes',
  '#title' => $this->t('Roles'),
  '#default_value' => (!$register ? $account->getRoles() : []),
  '#options' => $roles,
  '#access' => $roles && $user->hasPermission('administer permissions'),
];

but this module adds its own role_change field to the user form and the core access check doesn't affect that. Or am I missing something here?

What if a user only has administer users? They cannot edit roles on user/UID and they do not have access to user/UID/roles.