Any authenticated user can download invoice.
Go to the download link, and change the invoice id. Download proceeds.
Downloading/Viewing of invoices should be based on permissions set.
Active
Code
you can use this patch if a patch is needed while waiting for feedback
Cannot reproduce the access problem on the 2.0.0-rc5 module version.