Currently all users are restricted to be able to merge translations from other projects in which they are maintainers. System administrators are bound by the same security rule and they should be allowed to merge from any project.
Note: this is about which projects are displayed in the UI for the user to select, not the security framework per se (SecurityFunctions).
We should probably allow any project maintainer (not just admin) to select any readable project as the source. (Although it probably does make sense to show the user own projects more prominently in the UI.)