@smashing hiding a button using css isn’t that great as if you turn off css all your buttons appear. Also bots can spider your pages and they’ll be able to see your buttons in the DOM.
There’s two steps to security here, if you think worse case.
Firstly ensure the route being called by the button has a permissions check on it so it can’t be hit by someone who knows the url.
Secondly remove the button element from the DOM so there is nothing to click.
Security by obscurity (hiding stuff) isn’t much security - it’s like hiding your key under the mat by your front door.
Sometimes that’s ok but it’s not a proper fix