Check access to the #nodes_by_type_link

If the user does not have access to the content overview page, this link is still shown

I don't think this would be a very common scenario, since I believe most sites allow editors to go to a place where they can see all content they have created? I have a hard time picturing editors with permissions to create content but not to see the list of content of that type. That said, I believe it's a good idea to not print 403 links if we can avoid. Let's just omit the link if the user doesn't have access to the admin content route.

Additionally it would be nice to change this url in the settings

On this one I am of the opinion that it's not worth adding the complexity for the few times this would be needed. It seems to me a legitimate scenario for custom code / preprocess tweaks, as you mention.