Restricted user able to create sales invoice even if not given permission

if a restricted user is given permission to view, create for customers and not for sale invoices,
even then restricted user can view and create invoices by going in customers

Why would you give a user permission to create, update and delete customers but not be allow him/her to create invoices?

I would have thought that access to customer updates was more important than invoice updates.