Hi David,
What a good way to explain this security issue. 
We have several endpoints that should be used only by Jira Administrators. To prevent broken authentication and privilege escalation, we are verifying the user permission on each request.
I would prefer not to do it to not impact our response times, but I didn’t notice any relevant impact on responsiveness.
Here is another article about it.
Regards,
Paulo Alves.