Fundamentally, block access is not checked before the dashboard block is rendered. If the block is placed in block layout then access is checked, but the result is irrelevant as the opigno_dashboard BlockService doesn't check anyway.
For UserStatisticsBlock plugin, for example, just set blockAccess() to point blank return AccessResult::forbidden(). Observe the block still displays on dashboards.
Access check prior to block render.
Active
3.2
Code