I've found that it's only interface bug.
Example:
1. First, I login as user with administrative permissions on requested file - I can see download link on file. I download file, and copy download link.
2. Then, I login as test_user with read_only permissions on requested file, and has'nt see download link, just as chaddn says. But when i paste direct download link, then file successfuly downloaded. And finaly, if I set no access permission - then I can't download even on direct link.
Seems like bug in WUI, not in permissions.
Sorry for my bad English. :)