Confirmed by @Jalexander.

@aaron, is there a reason $wgLogRestrictions shouldn't apply here? It looks like the check is missing from RevDelLogItem::canView() (seems like revdel should account for it at that layer), and from SpecialRevisionDelete when calculating $this->mIsAllowed or SpecialRevisionDelete should just check for this special case and error out if it happens.

I would add a check to RevDelLogItem::canView function because that is already checked in Special:RevisionDelete

diff --git a/includes/revisiondelete/RevDelLogItem.php b/includes/revisiondelete/RevDelLogItem.php
index 49adf20..dbc6225 100644
--- a/includes/revisiondelete/RevDelLogItem.php
+++ b/includes/revisiondelete/RevDelLogItem.php
@@ -40,7 +40,10 @@
 	}
 
 	public function canView() {
-		return LogEventsList::userCan( $this->row, Revision::DELETED_RESTRICTED, $this->list->getUser() );
+		global $wgLogRestrictions;
+		return LogEventsList::userCan( $this->row, Revision::DELETED_RESTRICTED, $this->list->getUser() )
+			&& ( !isset( $wgLogRestrictions[$this->row->log_type] )
+				|| $this->list->getUser()->isAllowed( $wgLogRestrictions[$this->row->log_type] ) );
 	}
 
 	public function canViewContent() {

I don't think that's quite right - *no one* should be able to hide suppression log entries.

In T96079#1643332, @Krenair wrote:

I don't think that's quite right - *no one* should be able to hide suppression log entries.

I don't see why suppressing suppression logs needs to be prevented. While it obviously doesn't make "sense" for someone to do such a thing, I don't see the harm, since anyone who can view the suppression log would be able to see the suppressed log entries anyways, and keeping MW's permission system general instead of special cased seems like a good thing.

It still works after 2,5 years to see suppress logs when using the log id. It is a small impact, because it already needs a sysop account, but it is not nice to filter suppress logs out of big list and than allow it on direct access.

Can we mark this public after 4 years to fix it with a patch on gerrit?

@Umherirrender - I'd say yes, especially given the nature of this issue. If nobody else objects, I can make this task public and you can push a patch up to gerrit.

public https://gerrit.wikimedia.org/r/#/c/mediawiki/core/+/507870/ links to restricted T222038, but the patch looks similar (a bit modern due to changes to LogFormatter over the time)