The description for user_can_edit in block_base is:

    /**

     * Allows the block class to have a say in the user's ability to edit (i.e., configure) blocks of this type.

     * The framework has first say in whether this will be allowed (e.g., no editing allowed unless in edit mode)

     * but if the framework does allow it, the block can still decide to refuse.

     * @return boolean

     */

It explicitly says that the block can say that it wants to be non-editable - even if the framework says it can be.

The way blocklib is written, the logic is reversed. It is written such that if the page is allowing the user to edit block (page->user_can_edit_blocks), OR block->user_can_edit(), then they can have the controls and use them. But I would note that if the user can't edit blocks on that page, they can never get into the editing state, so user_can_edit never comes into play.