permission_callback is not optional

Omitting permission_callback registers a route that anyone can call. It works, there is no error, and this year there is not even a warning — the notice that makes it obvious does not arrive until much later.

register_rest_route( 'shop/v1', '/orders', array(
    'methods'             => 'GET',
    'callback'            => 'shop_list_orders',
    'permission_callback' => function () {
        return current_user_can( 'edit_shop_orders' );
    },
) );

// deliberately public, and written down as such
'permission_callback' => '__return_true',

The rule worth adopting: every route gets one, and a genuinely public route gets __return_true explicitly, so the reviewer can tell the difference between a decision and an omission. Returning a WP_Error from the callback rather than false lets you control the status code and the message, which is the difference between a useful 403 and a confusing one.