node entity type doesn't declare its admin_permission

I believe that is by design, node's admin permissions are a bit muddled at the moment. See #3552027: Deprecate "administer nodes" permissions

An admin permission is an optional feature that entity types can use to simplify their access checks, it is not required to have one and I'm not sure that node should. definitely not administer nodes. This information should never be used directly except in the default access control handler implementation.

Using that permission directly for anything can result in security issues. admin permission is designed as a fallback if no other logic is implemented. entities may have special rules that prevent them from being deleted/updated for example.

And node uses bypass node access not as a fallback but as a full access bypass, skipping things like node grants checks. This would not be compatible with how the admin permission is checked and couldn't be removed when using that.

No I guess it is not, at best indirectly by stating that custom access control handlers can override whatever default behavior it implies. And there are a bunch of places in core that do use the admin permission that I guess could be problematic. But they are mostly defaults that modules could override if they want, such as the default collection route and json api filtering. I think it would be good to document that it must not be assumed that an admin permission allows arbitrary access and that only using the entity access API for a specific entity is the canonical source of truth in regards to what a user is allowed to do with a given entity. (and I guess query access, but that's another can of worms).

And there are a bunch of places in core that do use the admin permission that I guess could be problematic

This is exactly what I'm worried about, adding the key could open up access to a bunch of places that the permission shouldn't grant access to.