Yeah the whole idea of $SECRET is that it uses /ppp/profile password= variable, which in RouterOS policy is “sensitive” - you indeed you do need policy permission for it.
Now the main benefit of using a “sensitive” attribute to store the “secret” is that stuff like API keys would not appear in :export to avoid leaking API keys. But unfortunately the same policy permission is required to use it.
In an ideal world RouterOS scripting would support persistent secure variables, since often some key/etc is needed for any /tool/fetch call to cloud services… $SECRET is still better than just embedding password in the script itself IMO, since even a “read only” user can see any keys in a /system/script source= attribute.