Someone has never seen the advanced permissions tab...
There is not "eh, they're all kinda bad" left in your head after you try to understand that mess. And forget actually being able to validate your permissions, it's basically impossible without some actually licensed fake account that you can use for testing.
Also, in what world is "denying someone access to a folder" the same as making the folder invisible? What went through the head of the designer?
All of them have different levels of pain.