Answer
Yes — this is controlled at the page level through the page's own client-side code rather than through permissions. Add a cruducations block to the relevant .client file for that page, which lets you declare, per CRUD operation (Create/Read/Update/Delete), whether it's enabled or disabled — optionally driven by a condition on the record's own data (for example, enabling Delete only when a particular field doesn't equal a specific value). This gives page-specific, even record-specific, control over which CRUD buttons appear, instead of an all-or-nothing permission-set-level restriction.