If you have no permission to edit a page, you still get a "view source" link in the right-hand sidebar when using the default theme. This link points to the page ID plus &do=edit. Normally, this would open a page with the page's wiki text, but in a disabled textarea.
However, when the Prosemirror plugin is enabled, this also displays a "Toggle WYSIWYG editor" button. The button even works, the editor loads, and users can edit the page in-place. Of course they get no save button because they lack permission.
Suggested solution: When a user has no permission to edit, show only the wikitext on a do=edit view. Don't load the Prosemirror editor and don't show the toggle button.