>On the individual file download pages, Update and Remove buttons are present and enabled regardless if current user has right to use them.

Yes, but once a click is done, the privilege validation will occur. A login will be prompted if not logged also.