FilterFormatAccessController always grants access for any operation on the fallback format

  protected function checkAccess(EntityInterface $entity, $operation, $langcode, AccountInterface $account) {
    // Handle special cases up front. All users have access to the fallback
    // format.
    if ($entity->isFallbackFormat()) {
      return TRUE;
    }
    // ...
  }

These are the first lines of FilterFormatAccessController::checkAccess(). As long as the format is the fallback, any operation by any user is allowed on it. Because nothing uses this code yet, this is not a security bug right now, but it will become one in the future as we will need to make routes use entity access, for instance.