I was under the impression that the permissions only kicked in once you were in 32-bit mode on the 386, what Windows called "386 Enhanced" mode.
The operating system/DOS extender could choose to let tasks (programs) run with the highest privileges, which would turn off some of the checks but not all of them -- you still needed valid selectors into valid slots in the descriptor tables.