List Employees Settings controls whether the Settings link shows up in the menu at all. In the current version, though, the Settings page itself does not check any permission when it loads or when it saves — the edit check in the code is disabled. Practically this means any admin user who is logged in and has a location selected can open the Settings page directly and change the paid/unpaid break rules, even without List Employees Settings or any other HR permission on their profile. If you need to keep break rules locked down, don't share that URL with roles you don't want editing them, since the menu visibility alone isn't a hard restriction.