Restricted user able to create sales invoice even if not given permission

1

if a restricted user is given permission to view, create for customers and not for sale invoices,
even then restricted user can view and create invoices by going in customers

2

Why would you give a user permission to create, update and delete customers but not be allow him/her to create invoices?

I would have thought that access to customer updates was more important than invoice updates.