Steps to reproduce.
1. Put a couple of portlets on the page.
2. Setup configuration permission only for 1 portlet.
Here everything looks great, you will be able to see only on 1 portlet option icon.
3. But, if you will change the page to customizable, the icons are shown on every portlet, regardless if the portlet has or not configuration permission.
Problem is, if you have no configuration permission on the portlet, you will see only empty page with text - "You do not have the required no permission.".
I think it is wrong behavior, because CUSTOMIZATION settings for the page replace portlet configuration permission.