In some conditions, content moderation fails to check a users access to use certain transitions, leading to an access bypass. In order to fix this issue, the following changes have been made to content moderation which may have implications for backwards compatibility:

https://www.drupal.org/sa-core-2018-006