Nice question.

But one doesn't need the specified permission to use DBCC INPUTBUFFER to look at the session one is running in. This has been true in every release since SQL 2000 (I don't know whether it was true for earlier versions). Of course that is a pretty restricted use of DBCC INPUTBUFFER, and more general use needs the VIEW SERVER STATE permission.