The Database module doesn't seem to respect the 'mod/data:comment' capability anywhere in it's code (in fact grep'ing for it returns only it's definition in /db/access.php).

Probably should be checked before printing the link to add a comment in the data_print_comments function (lib.php), and maybe a catch-all require_capability call in comment.php?