The spec. is pretty explicit about how the case must be handled when a client creates a monitored item and does not have the according right to read that node:
https://reference.opcfoundation.org/Core/Part4/v104/docs/5.12.2
"When a user adds a monitored item that the user is denied read access to, the add operation for the item shall succeed and the bad status Bad_NotReadable or Bad_UserAccessDenied shall be returned in the Publish response. This is the same behaviour for the case where the access rights are changed after the call to CreateMonitoredItems. If the access rights change to read rights, the Server shall start sending data for the MonitoredItem. The same procedure shall be applied for an IndexRange that does not deliver data for the current value but could deliver data in the future."
Now for consistency probably an Event MonitoredItem shall be handled the same way...
Problem in that case:
The right "ReceiveEvents" (the missing right for "ReceiveEvents") prohibits that the client will ever get any notification for the according monitored item...
For the user this will be very surprising since there has never been any "Bad" indication that something went wrong/is going wrong but he never receives any data for which he subscribed for.
It is also quite complicated on how to handle it when sending a first initial notification to the client since for the server node (subscribing to all events for the server) the user might have the rights to get some events (of some nodes/some namespaces/some nodes of some namespaces)...
And also the server will be checking for every event wether he has updates for the user.
This might also lead to many users having open subscriptions and MonitoredItems for events never receiving anything (and the server allocating resources with every event checking on wether or not to send updates to them).
TLDR:
It does feel very weird that the client will have successfully created a subscription and a monitored Item for events and never get any event and also does never get any indication that he is not allowed to receive events for the given node .