Custom permissions (for menu item) are checked here but not really used anywhere.

If the user does not have the minimum permission for the menu, the app_list entry should be removed entirely (probably here to keep template logic simpler).

As an extra, it could be interesting to have the menu item removed if there is no minimum permission for the sub-entries either. But it needs to be verified whether or not top items can be links directly (so that would be another check).
This could actually be the only check (and removing permissions from top key)