The _isAllowed method is where you, as a Admin Panel programmer, should place your ACL checks. As you can see, by default, this method returns true. That means if you don’t define your own _isAllowed method your Admin Panel features will be open to any user with an Admin Panel account, and people using your code will have no way to restrict access to your features. This may not be a problem, but it’s definitely something you should be aware of.
_isAllowed (so it always return true as inherited from parent class), I tried with another account as a role that doesn't have that resource checked in the Permission -> Role.
Using that account, I cannot see that resource in the admin menu. Also when trying to access that resource by modifying the URL, I got redirected to Dashboard.
So it seems pretty secured to me, just wondering what's the reason (if any) we better override that