The component and dashboard tile are only visible to Super Users and Admins. So far, settings can only be accessed by Super Users.
Starting with version 2.5.13, this will be restricted to Super Users by default, but there will be a switch to also grant visibility and access to regular Administrator users (who can still be selectively excluded under the Backend Protection menu item as before).
I don't think a full, finely tunable ACL implementation makes much sense, since HTProtect is basically an admin-level thing.