Quite right, Howard. I understand how it works, which is bizarrely.
But
the code should check both - especially if you are going to *force* the
menu item to be present for all users with no tool to manage the menu. If the repository is disabled, it should not be on the menu. That's the
standard behavior consistent with disabling any sort of plugins, reps, mods, blocks, etc.
The
Clean theme in 3.2 does not show a Private files link at all in the
standard Navigation block, even when the repository is enabled. So this menu item is specifically added to Boost.
A related issue from the OP is the calendar menu item. The permissions workaround does not seem to work for Calendar.
If I set moodle/calendar:manageownentries to Prohibit for Authenticated user, I still have the Calendar menu item and can still reach it.
This is also true in Clean, too, from the Navigation block > Site pages. So I suspect that it doesn't check at all, and maybe never did.