A button created with StaticUIHtmlEditorButtonFactory doesn't check if it has the authorization to be displayed. Even if the profile does not have right to use the button, it can.

Sample of code that is not handled in file plugin.xml :

<extension point="....">
<Static>
.....
<Right>ANWRT_Rights_Expert</Right>
</Static>
</extension>