The DataObjectManager class will show edit & delete links for objects based on a global permission, ignoring whether any items would return false for canEdit() or canDelete(). For example, let's say that someone added fine-grained permissions to files in the assets folders. These permissions would simply be ignored.
NOTE: The underlying ComplexTableField has the same problem.