Technically I could argue this is not a bug.

Removing submit permission is only going to affect adding, so it's correct the whole CMS module doesn't disappear - maybe there is permission for editing still, or something else.

Permission could instead be removed to the cms_news page or the whole cms zone.

As for the form still being there, there could be permissions overridden on a category level to any of the news categories. As it happens, there aren't, and thus the list is empty. If they try and submit it will say they didn't select a category. Composr isn't going to be linking to that form normally, but it is conceivable for a site with complex permissions to have added custom links to submit to a particular permissive category..

But I do recognise it is messy. It should at least have an error message if there are no categories to select from rather than waiting until form submission. I'll handle it as a 'there are no categories' situation. That's technically not the correct error message, but there's no distinction between "no categories" and "no categories available to you" and I don't want us to have to create one.

Automated response: Possible to manually go to add news/blog/event URL even with no access

If you have no access to add news/blog-posts/calendar-events, the normal links and icons for doing so will be missing. But you can manually go to the form URL. No categories will be available for selection unless a category has been given overridding privileges to allow submission for that category/categories only.
It's a messy situation, we should not show empty lists that require selection. Show a generic error message instead.

From a user perspective, not having links to modules where actions cannot be performed is a good solution that eases any potential confusion. Thanks for the changes.