This is less important now, as Sitemap nodes can be included and these automatically check all permissions. Explicit checking for manually inserting menu nodes would be nice in some rare circumstances.

A workaround is to re-encode permissions in the match key field, e.g.

{$?,{$IS_IN_GROUP,2\,3\,4},,_never_}

That should make it so that only groups 2, 3, and 4 can view the page, because anything else is going to get a match key of _never_ which can't pass.

Works a treat - thanks Chris !