Enabling module without adding permissions doesn't restrict anything

This could be due to 🐛 Field permissions access override Fixed . Needs testing.

This might be an Inline Entity Form issue. What happens when you visit the add form for that entity type (/admin/content/<entityType>/add/<bundle>)? Is that page accessible? I just tested with those pages and that seems to work. This module is implemented with default entity access checks, so if this works on the default entity add routes and not when using Inline Entity Form, the issue probably lies with that module.