Give the gift of Drupal. All merchandise is 50% off through 2016.
If a user can see user/UID/orders/OID, then they also have access to admin/commerce/orders/OID/view.
This isn't apparent, as there's no link from one to the other.
But it means that fixing-- which would add that link -- can't rely on menu item access.