The products permissions settings for staff should also apply to staff members who have access to invoices. They should not being able to add products from the invoices page.