That doesn't make it permissionless. The parent is right. USDC is closer to an IOU than a permissionless ERC20 token because the contract it uses has been modified for the centralized blacklist functionality and can lock you out any time.

It's the same as a centralized bank. If you get your salary deposited you can also go and take out cash immediately, but until you do, you don't truly own the par value.