> A CRDT assumes that every participate has equal rights to all data.

This is not true. CRDTs assert properties related to consistency and availability, they don't assert anything related to authentication or authorization.