As the title says, paintings are breakable by players who are set to "Visitor", meaning they should have no interaction in the world. I only found this out after building a spawn area in my survival world at the world spawn, and setting up paintings to make things look nicer. I then decided to do some testing with other non-living entities, and found that minecarts are also affected by this issue, making it quite annoying if a friend joins that likes to troll you or mess with you, and you don't want it.

Steps to reproduce:
Create any world in creative mode
Place a painting on a wall, and a minecart on a rail
Switch to survival mode, and set your permission level to "visitor", which equates to having no permissions at all
Punch the painting and minecart, you'll be able to break both

Expected Result:
You should be unable to interact with the paintings or minecart, as you're unable to interact with anything else

Observed Result:
Anyone can break paintings or minecarts even when they shouldn't be able to as visitors.

Paintings and minecarts should, at the very least, require the "attack mobs" permission to be broken, to coincide with other entities in the game.