Users add payments to order without editing order
Have found the answer in "commerce/modules/payment/commerce_payment.module" 

Lines 964-972

    // Creating new payment transactions.
case 'create':
  if (user_access('create payments', $account)) {
    // We currently allow any user to create any payment transaction,
    // regardless of the order, because entity_access() doesn't give us a
    // way to discriminate on the order.
    // @todo: find a way to prevent creating a payment transaction if the
    // user doesn't have access to the order.
    if (!isset($order) || commerce_order_access('update', $order, $account)) {
      return TRUE;
    }
  }
  break;


need to be updated to the following

    // Creating new payment transactions.
case 'create':
  if (user_access('create payments', $account)) {
    // We currently allow any user to create any payment transaction,
    // regardless of the order, because entity_access() doesn't give us a
    // way to discriminate on the order.
    // @todo: find a way to prevent creating a payment transaction if the
    // user doesn't have access to the order.
    if (commerce_order_access('view', $order, $account)) {
      return TRUE;
    }
  }
  break;


This does not appear to have any security implications.