"Webform submissions" view default display does not have any access restriction

For sure this module must not depend on the "View published content" permission. Depending on "access content" permission usually leads to security issues, just check the root cause behind some some SA-s.

I guess "administer webform submission" would be a more secure default value?

All the view displays are embeds. Is the default actually used anywhere? The permissions should probably be administer webform submission. Tests will need to be updated.