You're correct, thanks! It only allows updates via email, so we still have CC'd users clicking on the web links and being denied access, but at least we can explain to them this workaround.
It's ok as a workaround, but it should be easy enough to permit CC'd users to put Notes into the tickets if they're in the CC field....hopefully coming in a future version!