Unless I'm off my rocker here, the installer creates symlinks for CD-ROM drives as /dev/cdrom, /dev/cdrom1, ... Although by default these devices are set up to be mountable by the user, /etc/security/console.perms only changes the permissions on /dev/cdrom and /dev/cdwriter as opposed to /dev/cdrom* and /dev/cdwriter
Fixed in pam-0.72-26.