Other value than false(undefined included) is equivalent to

sorry, didn’t know that npm start automatically sets NODE_ENV=development, anyway the code about REACT_APP_ENABLE_PERMISSIONS could be this way to handle potential undefined values?

I see, but I don’t use .env, so that variable is totally missing (undefined) and I think in such case the default should be true

It's just  behaviour enabled for dev purposes.You can disable it by removing the REACT_APP_ENABLE_PERMISSIONS=false  or setting it to other value except false, in .env.development.