I think I spoke too soon.

The module works perfectly, but if you've customized the product view using node-product.tpl.php (as I have), this overrides the permissions.

I'm back to square one now.