http://symfony.com/doc/current/cookbook/security/acl.html is how it 'should' work? If we do it this way it'll need 2 other dependencies. So maybe it's not necessary yet?

This logic is also only used when you call it manually. The NodeAdminController still uses its own code. There should be a big refactoring that calls the ACLPermissionCreatorService for every scenario. This moment seems like a good time to remove the dependency on the ObjectIdentityRetrievalStrategyInterface.