Various binaries call out to systemd as you can see. When you iterate on the permissions set, that results in permissions that are far wider than what shutdown should allow (this is because of systemd’s design).
Use this instead:
dbus-send --system --print-reply --dest=org.freedesktop.login1 /org/freedesktop/login1 "org.freedesktop.login1.Manager.Reboot" boolean:true
All of PowerOff, Reboot, Suspend, Hibernate, HybridSleep, CanPowerOff, CanReboot, CanSuspend, CanHibernate, CanHybridSleep, ScheduleShutdown, CancelScheduledShutdown are supported. See https://www.freedesktop.org/wiki/Software/systemd/logind/ for details.