Players without permission see all nbteditor commands in tabcomplete in 1.13.2. This is because there is no permission setup correctly. Bukkit also has a solution for this in the form of setPermission:
https://github.com/Bukkit/Bukkit/blob/master/src/main/java/org/bukkit/command/Command.java

Thanks for the heads up. I'm not using the standard way of registering commands, probably missing a permissions test somewhere. I'll look into it.