Answer
This is controlled by the EE_NOTES_CONFIG presentation object, which governs the ability to view and create Notes and is granted by default to the FND_ENDUSER role. Restricting or granting this specific presentation object on the relevant permission sets controls exactly who can view/edit Notes.