Products and variations are bypassing access control

Discovered when trying to finish #2741295: ProductVariationStorage::loadEnabled, loadFromContext do not respect product variations access rules with a test.

/**
 * Implements hook_entity_access().
 */
function commerce_product_entity_access(EntityInterface $entity, $operation, $account) {
  // Allow published products to be viewed by all users for now.
  // @todo Remove once we implement the full product permissions.
  if ($operation == 'view') {
    if ($entity->getEntityTypeId() == 'commerce_product' && $entity->isPublished()) {
      return AccessResult::allowed();
    }
    elseif ($entity->getEntityTypeId() == 'commerce_product_variation' && $entity->isActive()) {
      return AccessResult::allowed();
    }
  }
  return AccessResult::neutral();
}

We never removed this when we committed the new acces handling.