Description from EZP-23881:

There are no policies used to restrict viewing/listing of Content Types and Content Types Groups.
One should be added, and assigned by default (in demo data / clean dump) to the users who need it.
We must pay attention not to break anything when content types are fetched in Controllers or other anonymous runtime code.