CiviCase not strictly adhering to permissions?
You might be right. The dashboard as far as I can remember has never used ACL's it just uses "my" or "all". The feature where ACL support for case was introduced might have been for a different need and doesn't seem to have included the dashboard (https://issues.civicrm.org/jira/browse/CRM-17645).

So yes and no to your question?