permission_callback has no effect

Are you sure that a _doing_it_wrong notice isn’t being issued? You won’t see the notice visibly output on the page because that would break the JSON response. But if you look in the headers of the response you should see a X-WP-DoingItWrong header.

It should also appear if you use a plugin like this to record developer notices: https://wordpress.org/plugins/log-deprecated-notices/