Wasn't it your site that had all plugins coded into the files instead of executed normally? In either case, the vB_Template class is defined when vBShop starts up, before any usergroup permission checking is done. So unless you somehow disable the PRODUCT for those people, it's not a problem in vBShop