Hook fires before current_user service can identify current user
Question in the title: Hook fires before current_user service can identify current user

The menu discovery process is not that dynamically, only runs when you clear the cache or make changes that need a rebuild. So the current user while rebuilding the menu has nothing to do with the current user of a request when the menu is displayed.

I want to make a menu link disappear when a user doesn't have permission to use it.

About the question behind this, what do you not like about the default behavior? Drupal doesn't show menu items the user has no permission for. If you want to do more adjustments probably the best place is in preprocess.