Hi John,
a lot of plugins use a filter so 3th parties can change the permissions.
WP Rocket uses the following:
if ( ! current_user_can( apply_filters( 'rocket_capacity', 'manage_options' ) ) ) {
This way the default capability is ‘manage_options’, but I can change that by using the filter.
Changing plugin/core files should never be done, so I totally agree with that.