That's right. As I said before, PDF consumers (viewers) are expected to honor any security restrictions. Since PDF is an open standard, the algorithm to decrypt encrypted content is published and thus well known. Given this reality, document restrictions by themselves cannot be considered secure, despite the use of that term when describing them. This is nothing new and has been well known since the decryption details were made public many years ago.
↧