When a user has permissions to edit a page which has a module with security denying edit to all users and allowing edit to an admin group, the content edit icon is removed but the settings icon is not. this allows any user to change the permissions on the module to allow edit on the content. The move icon is also still present so a user can move the module on the page. This seems to defeat the intent of controlling the edit access of a module that is visible on all pages such as a footer.