Setting cache max-age to 0 doesn't work if you still have the core module Internal Page Cache enabled.
Read the documentation why you probably want to disable this module or deliver the block with a different method:
Websites that serve personalized content to anonymous users (dynamic,
per-session, e.g. a shopping cart) will want to disable the Internal
Usually you restrict a block to a Content Type, Pages or Roles (or a mix of them) when placing the block in the block edit dialog - see https://www.drupal.org/docs/core-modules-and-themes/core-modules/block-module/managing-blocks
Still, this will not handle caching for your dynamic block content.
If you want to make this "switch" in your build ...
You can alter the permission used to access a route, as described in Altering existing routes and adding new routes based on dynamic ones. In the specific case, the code used in alterRoutes(RouteCollection $collection) would be the following one.
Since the administer site performance permission is a custom one, it needs to be added as new permission by the ...