I got the same issue.
Our developer users (rootadmins) can see the newly applied theme on a sheet, but the restricted users can't.
Any solution yet?
I found: "((user.name="firstname.lastname@example.org" and resource.objectType="appprops"))".
if you apply this on "App.Object_*" and give select"read" rights, it works for this specific user.
still need to check if im not overruling other security though....
We were able to fix this issue by creating a custom default app rule:
resource.resourcetype = "App"
(resource.resourcetype = "App.Object"
and resource.published ="true" )