Steps to reproduce the issue

1. Create a user group "Test User Group".
2. Create a user "Test User" and assign to "Test User Group".
3. As a super user, navigate to the global configuration, and click permissions.
4. Click "test user group" and ensure it can log in to administrator. Save.
5. In the configuration, click on media, and click permissions.
6. Select "Test User Group" and set "Access Administration Interface" and "Create" to "Allowed", and ensure all other permissions are set to "Not Allowed", like so:

Expected result

Test user can see and navigate media, but cannot rename, delete, or edit images or folders.

Actual result

Test user has full permissions via the quick icons.

System information (as much as possible)

Joomla 4.0.5
PHP 8

Additional comments

The "create" permission works as expected. It just seems that those icons that appear on hover do not respect permissions at all. This is also true from the image select field.