Route subscriber to prevent users without the certain permission's or role from accessing pages (Webform admin pages example)

custom_module.services.yml

services:
  uwl_webform.route_subscriber:
    class: Drupal\custom_module\Routing\RouteSubscriber
    tags:
      - { name: event_subscriber }
      

RouteSubscriber.php

<?php

namespace Drupal\custom_module\Routing;

use Drupal\Core\Routing\RouteSubscriberBase;
use Symfony\Component\Routing\RouteCollection;

/**
 * Listens to the dynamic route events.
 */
class RouteSubscriber extends RouteSubscriberBase {

  /**
   * {@inheritdoc}
   */
  protected function alterRoutes(RouteCollection $collection) {
    $routes = $collection->all();
    foreach ($routes as $route_name => $route) {
      switch ($route_name) {
        case 'webform.addons':
        case 'webform.help':
        case 'webform.config':
          $route->setRequirement('_permission', 'administer webform');
          break;
      }
    }
  }
}

Useful documentation: https://www.drupal.org/node/2092643#section-requirements
https://www.drupal.org/docs/8/api/routing-system/altering-existing-routes-and-adding-new-routes-based-on-dynamic-ones