Restrict access to ECK full page, but allow embedded
It turns out that though the entities created by ECK are dynamic, they do have route definitions, so we can use this to restrict access, in a hook_preprocess_page placed in a custom module.  Also worth noting that the administrative list display at /admin/content/my_eck_entity is visible to anonymous users when you set the view my_eck_entity entities permission to anonymous users, so we must also look out for this route as well. 

use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;

/**
 * Prepares variables for page.html.twig.
 */
function mymodule_preprocess_page(&amp;$variables) {
  $route_name = \Drupal::routeMatch()-&gt;getRouteName();

  // Restrict access to ECK canonical full page display and the entity
  // administration list screen to content authors. Restricting full page
  // display helps to avoid mistakenly indexing the content in search engines
  // because these entities are only ever going to be seen by anonymous users
  // when embedded into other pages via WYSIWYG embed or rendered entities
  // from entity reference fields on other node types.
  $user = \Drupal::currentUser();
  $restricted_eck_entities = [
    'my_eck_entity', // Replace this with real entity type machine name!
  ];
  foreach ($restricted_eck_entities as $eck_entity) {
    if (
      (
        $route_name === "entity.$eck_entity.canonical"
        || $route_name === "eck.entity.$eck_entity.list"
      )
      &amp;&amp; !(
        $user-&gt;hasPermission("create $eck_entity entities")
        || $user-&gt;hasPermission("edit $eck_entity entities")
      )
    ) {
      throw new AccessDeniedHttpException();
    }
  }
}