The SA-CONTRIB-2020-020 security patch was titled "Further restrict anonymous user access to anonymous orders."
Unfortunately it seems to have broken some sites I work on. We are now seeing access denied errors on admin/commerce/orders/xxx for "semi-trusted" users who have permission "Default: Update orders". For these sites the security patch was a non-back-compatible change and I have raised an issue for that.
The solution that worked for me is to grant the semi-trusted users the "access commerce administration pages" permission.
However I am nervous because this permission doesn't seem to have clear documentation. I don't wish for these "semi-trusted" users to suddenly gain extra access that they should not have such as to edit products.
Please can anyone confirm the effects of this permission? Does it do nothing alone and only work if other permissions are added?