Comment 3 for bug 1224751

 > The rules are this way because the shared memory files are not app specific and is possible for one app to access
 > another app's shared memory file.

The pulseaudio server actually uses the same shm file for all outgoing memory blocks (i e, the common case is recording). So for best app isolation you also need to change this into one shm file per client connection.

In addition, every pulseaudio client has one shm file for all outgoing memory blocks (i e, the common case is playback).