Some intended-for-internal-use DataStore methods already have authz checks (e.g., inventory management), but others do not (e.g., Oximeter collector/producer management). They all should, although as long as they're only called by internal-to-Nexus systems (RPWs, sagas, etc.), this presumably isn't particularly urgent.