Some time ago, the paste permission was tied to 'Modify portal content', so we've monkey patched it to 'Add portal content' and left ourselves a pointer to the relevant Plone ticket.
The ticket has bitrot in the meanwhile and I'm now wondering whether I could rip the monkey patch out already.
Based on a mailing list discussion @seanupton might have PLIPped and PRd this into
plone.dexterity for 4.3 - did this ever happen?
Seems like it could have gone into 5.0 by @vangheem, but did not spot relevant code anywhere so far.