It works fine, but when you add a custom capability then that capability needs to be given to any roles who need it, including administrators.
This isn’t the responsibility of Meta Box, it’s up to the admin to provide the appropriate permissions to any roles that need it.
That's correct. I think a plugin like Members would do the job better than Meta Box, since it's too verbose for capability management.
I'll add the info to the docs when updating the plugin.