Turning off Who Can Read on a Type Model is likely to cause errors

Summary: That is, if User U can't see a Model (due to Who Can Read), which is used by a Type used by a Property used by a Thing that U can see, they're going to get errors.

This is just a thought experiment as of yet, but I'm fairly sure it will have problems.

How should we deal with this? We don't apply Who Can Read to Properties, for this reason; should we be ignoring it for Type Models as well? That implies that we need to somehow flag Type Models in a way we can efficiently detect.

For the moment, this is a "don't do that" edge case, and the errors are just read-side, not data corruption, so this isn't Critical. But it's ugly, and we should think about how it works.