How can we improve WHMCS?

Currently, any client subaccount can view invoices on that client account if they have the invoice URL. This includes if the "List Invoices" permission has not been granted.

Can we please add a "View Invoices" permission for client subaccounts so that invoice viewing can be controlled by the owner of the service?

Alternatively, only allowing subaccounts that have the "List Invoices" permission assigned to view invoices would also be a good fix.