I tried in Dev300_m38 the new PDF password security UI, I think the set/unset
behavior of the buttons is handy, but I miss the possibility to set the
permission password only (and have the file encrypted) and at the same time have
the file read by everyone.
That is, in specification at
http://specs.openoffice.org/appwide/pdf_export/PDFExportDialog2.odt , on row
146, the sentence  “Setting only the permission password will force the open
password to be the same†has a side effect: you can no longer export a PDF file
that can be read by everyone and at the same time have some permission set
through a permission password.
IMHO , this is the vast majority of the PDF files available on the web.

Another observation is about the new strings.
According to 3.5 of PDF 1.4 specification, the document is encrypted as well
when you specify access restrictions (e.g. the possible use of only the owner
password).

Then you can have four level of access to a PDF document:

a) no password: PDF is not encrypted, then no access restrictions (print, copy,
etc...): anyone can read anyone can change the document;

b) permission password only: PDF is encrypted, access restriction can be applied
(limited print, cannot copy, etc...), only if you know the permission password
you can change access restriction: print, copy, etc..; but anyone can read it;

c) open password only: PDF is encrypted, you can open the PDF document only if
you know the open  password. In this case the user who knows the open password
has no access restriction because the OOo PDF export filter enables all the
access rights (see 3.5.2 of PDF 1.4 spec, for an explanation of expected PDF
viewer action);

d) both open and permission password set: PDF is encrypted, points b) and c)
both apply together.

May be strings at #3 and #5 on table 4 of the OOo PDF export specification need
to be adjusted?

In any case it seems that the change was only made in the UI, the API behavior
seems unchanged.
 
This was first exposed in issue 69923 but I missed the point then, sorry.
I had time to build a 3.1 targeted version only now.