Ian,

> Does this mean that the embedded client ignores all grants in the
> database?

No. It just ignores passwords.Grants work the same way.

> This is a huge security hole.

This is embedded version of a server. It requires direct access to the
database file. It isn't supose to be secure.

> Could you copy a protected
> database (with a sysdba role for example and various users with
> different access rights) to a machine with the embedded server and
> access all the tables?

Yes. The dificult part for you should be copying the database - you
shouldn't have direct access to the database file(s) - they should reside on
a server that has a file system that shouldn't allow you to access directly
the files.
It's the same with the server version.

This will be the same for "embedded" databases - just use the options that
your operating system gives you to protect your databases from beeing
accessed for other people - put them on a folder that no one else will have
access.

Artur