Ello there.
I can restrict user access to pages that haven't had their template edited.
If I create a new custom php page that outputs content and then have a WordPress page that uses that as a template, it doesn't restrict the user access to it.
I have it identical to the page.php template just with additional content (mainly getting sessions and echoing).
Google didn't help much and nor did any other restriction plugins.