The combination of admin ui not disabling the create button and that UrlAliasController performs no checks if the user is allowed to create urls, a user is allow_content_types to do so even if they do not have the rights to url.

Perhaps url policies should be separate from polices for urlalias.