Hi Anh,
It works fine, but when you add a custom capability then that capability needs to be given to any roles who need it, including administrators.
This isn't the responsibility of Meta Box, it's up to the admin to provide the appropriate permissions to any roles that need it.
The only thing I'd suggest is that you might want to add some information to the documentation because many people won't know this otherwise.