Users with EXTENDED_READ permission should be able to see Job configuration modifications. Sometimes Jenkins admins might want that their users are able to see the differences so they can understand why a specific build is failing.

However, users with this permission shouldn't be able to see config modification, neither to restore a job configuration