Considering now every time you want to do anything on a computer you're getting interpreted code in a memory heavy gui environment to send a HTTP request over a TLS connection to a remote computer via a flaky wifi connection, the cost of doing an indirection might be relatively much less than it was a decade ago. In those days, you might recall, most of the time you clicked in your software it would be doing direct lookups in the machine's comparatively fast spinning disk using native compiled code in a gui api designed with a considered tradeoff between developer's convenience and memory usage - designed in the days when there were fewer developers and much less memory.

Of course, half the time those indirections will probably be remote to the server you're already waiting on...

An ACL implies a level of indirection, and typically a look-up as well.