Is this fixed now?

You can place, without metal frags or codelock in your inv, on boxes and doors. The permission to prevent this doesn´t work anymore.

Seems to be fixed in the current version. Have you also checked the perms "item.bypass"?