There a "problem" undocumented in the sfPJSPlugin.
If you create an action that will serve a javascript in a permission protected module, in exemple entreprise/jsSearch, the javascript will not be accessible because the plugin forward the javascript call to tje sfPJS/index action. But this one is not accessible !
So we have to create a sfPJS module in our application, with a security.yml filled like that :
index:
is_secure: off
With that, the plugin action is accessible, and the normal persmissions defined for the real action entreprise/jsSearch (the one that render the javascript) are respected.
So we have to create a sfPJS module in all our applications with a security.yml and the index action unsecured.