They are correct, a user on iTunes Connect has access to all apps, no matter what their role. Obviously this is a terrible design, but Apple has never been too quick to fix design flaws in iTunes Connect.
Keep in mind that your numbers will not always match the official reports. It all depends on the timing of when credit card transactions complete and money is actually posted, etc.
Best Answer
You can not enable apps in the latest version of iTunes. All apps are now downloaded and managed from the iPad or iPhone.