Multicluster access review checks does not work with impersonate mode.
If the first check is performed in impersonate mode then after leaving that mode the value will still be used. If impersonated user has lower access rights (which is the case most of the time) then this will block access to VM actions (until full page reload).
The same scenario works with screens that use regular access checks i.e. Pods or VirtualMachineInstances

4.21

always

1. as a cluster admin go to Users
2. reload the page to clear the cached checks
3. impersonate user with view only access
4. go to (some) VM details and view the VM actions - all actions should be disabled
5. leave impersonate mode
6. check the same actions

actions are still disabled

all actions are available as the user is cluster admin