Thank you for the report. We have confirmed that this is a bug in the editor content provider. It only checks permissions at the web level and ignores specific list permissions. The bug will be corrected in the next MOSS RadEditor release (scheduled for the end of next week).
the Telerik team