Reopening this issue.
I further noticed the FM 'PT_ARQ_READ_INFOTYPES' is used to retrieve employee leave overview from IT2006 and IT2007 using FM 'HR_READ_INFOTYPE'. Just before calling the 'HR_READ_INFOTYPE', FM 'HR_READ_INFOTYPE_AUTHC_DISABLE' is called to disable authorization check. So there is no authorization check at all for the leave overview application.
Not sure if there is any place we can enable auth. check for this. Let me know if you are aware of this and how to fix.