Question: It seems that Access permissions like Edit Own are not enforced when calling update_post_meta, is that correct?
Answer: Yes, this is correct. Custom code implementations should utilize current_user_can to compare capabilities before calling update_post_meta, etc. directly.