Reproduced and fixed against XWiki 17.10.9 with the demo content installed.
Before, a user who is not even logged in is shown the 36 pages the migration would rewrite, and the link that starts it: !rn110-before.png|thumbnail!
After, the same anonymous request is refused: !rn110-after.png|thumbnail!
A wiki administrator still sees the list and can still run the migration.
