Different 404 behaviour on custom URL
Pasting the code made me think about the problem in more detail.

It's a question of which gets sent first: 403 (Access Denied) or 404 (Page Not Found).

If it's a legal URL ("library" or "library/valid-category") but the user doesn't have access, they get a 403 and redirected.

If it's not a legal URL ("library/invalid-category") it gets reported as a 404 ... even though they don't have access anyway.

Makes sense.