Content type slug in route, how?
Do you have an entity type or a content type? If you create one in the UI, it's a content Type. Then it really is a node, so what you want to use is {node}. Then upcasting will work (assuming you have NodeInterface $node in your controller).

That said, access denied is, as Ivan Jaros said, the missing access definitions. The default access definition is that that access is denied. access: 'TRUE' will give anyone access.

What you likely want to use is _entity_access: node:view then the standard node access system is invoked and the user has access if he can view that node.