When a hook rewrites the user's input, permissions are now re-validated against the modified input. This prevents hooks from bypassing permission checks by rewriting a denied command into something different.
Evidence
Permission re-validation (search for "ask rule on hook-rewritten input")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.