drupal_set_message is visible only to those with permissions for the operation?
No, it doesn't. It means that if you want to get the list of the messages set from other modules, you just call the function without any argument; this is what drupal_get_messages() does to get the list of messages set by the modules.

function drupal_get_messages($type = NULL, $clear_queue = TRUE) {
  if ($messages = drupal_set_message()) {
    if ($type) {
      // …
    }
    // …
  }
  // …
}


If the message should be visible to users with a specific role, it is the caller that needs to first check the user's permissions with user_access() as in the following code, executed from comment_form_submit():

  if (!user_access('administer comments')) {
    drupal_set_message(t('Your comment has been queued for review by site administrators and will be published after approval.'));
  }


This doesn't need to be done in a form submission handler, if who uses the form is already restricted to who has that permission.