I think you are mistaken. Unless I'm missing a bug in the code. 

The user can't call and shouldn't call setUIAcls... its private.  The only reason it was added was for the history server to call it.  Honestly not fond of having it at all but it was the only way to make the history server work without major rework.  The UI does always honor the spark.ui.acls.enable (or setUIAcls which is set to whatever the application has set for spark.ui.acls.enable from the history log).    

spark.ui.acls.enable is controlled at the application level and is always honored at the application level. The history server does not override it.   I put a comment in the code in HistoryServer.scala that says we could do that if we chose. That is actually how the mapreduce job history server works.  That allows admins to have more control over it and doesn't rely on the user to do the right thing.  if the history server ui.acls.enable setting is true then its enforces acls across all applications no matter what the application set it to.  I chose not to implement it that way though