doesn't respect 'create' permission for referenced entities

I have a user with the permission to edit any 'referencing' node, but not the permission to create 'referenced' nodes.

However, with the 'Allow users to add existing' option enabled for the field, this user can add 'referenced' nodes with the widget.

Is this a bug or by design? Comment at #2056139: Add option in setting to "Prevent adding a new entity". suggests that this shouldn't be happening.

If this is by design, extra text on that field option to notify the admin user of this behaviour would be a good idea.