Reviewed action workflow addon broken

Which workflow is presented to the user is determined by the rights of the user currently logged in.

In the case of the reviewed-action application:
johndoe should see the basic version, systemuser should see the full version

However: all users (including anonymous) allways get the full version

Reproduction path:
Start the reviewed-action application (both repository and frontend)
In a browser go to localhost:8082
Navigate to workflow-demo/myarticle/myarticle

=> On the right you see the full version of the workflow plugin (including publish, unpublish etc.) even though you aren't logged in! (anonymous)