With a standard user/developer after clicking the drop down, takes to a 'does not have permission to access this page.' so that's good.

Seems it already requires jira administrator? just documentation needs updated? or also require bulk change?

(It's ok to have it still in drop down even if don't have permission, so people know it's possible.)

Import Issues from CSV (plugin) in Jira 6.3.3 via Jira Importers Plugin 6.2.3 correctly requires Create Issue permission, however it should also require Bulk Change permission (seems to already require jira administrator permission.

ie
/secure/BulkCreateSetupPage!default.jspa?externalSystem=com.atlassian.jira.plugins.jira-importers-plugin:bulkCreateCsv
JRA-39477
https://confluence.atlassian.com/display/JIRA/Creating+issues+using+the+CSV+importer