I have found the issue.
Previously settings have been used for extra block creation, now it's customSettings
Changing everything accordingly fixes issue.
Disabling a particular Navigation doesn't prevent the user to browse its route
As an admin disable the navigation, let's say, Users.
Open an Incognito window and the Users icon is not displayed. Good enough! In the URL bar, type localhost:4567/users and the users page is displayed. In fact, the user should not be able to browse the route even.
These are available in other places. For instance, you can "Hide user list and data from guests" in ACP -> Settings -> User