Update Credit Card info Permissions
Is it possible to sign up as a subscriber without admin approval? If so remove the access CiviCRM permission right now!!! There is no way that with a publicly available account that I should be able to get any level of access to CiviCRM.

Apologies if I misunderstood and all subscribers need to be approved. Your case may be an instance where you want a custom portal - lots of orgs do this. Even then, they generally (is my understanding) allocate what can and can't be accessed without the access CiviCRM permission.

John