The description for user_can_edit in block_base is:
It explicitly says that the block can say that it wants to be non-editable - even if the framework says it can be.
The way blocklib is written, the logic is reversed. It is written such that if the page is allowing the user to edit block (page->user_can_edit_blocks), OR block->user_can_edit(), then they can have the controls and use them. But I would note that if the user can't edit blocks on that page, they can never get into the editing state, so user_can_edit never comes into play.