You discovered the real bug. Old feature was lost due to use of the hard coded path inside the code. Version 4.21 includes a fix for this bug:
Fix: Removed hard coded folder name (user-role-editor) from the used paths. User Role Editor Pro is hidden now from a user without permissions (administrator or ure_edit_roles), even if a user has access to the ‘activate_plugins’ capability.
You may restrict plugins available for the activation/deactivation at the user level:
Could you please test plugins access related part with the development version 4.21.b7?
It’s available after login from the Downloads page.
I look at the free version of the theme to understand if it’s possible to change something with access to the tabs at its options page.