Yes, just do a permission check when the event runs. PHP: if ($player->hasPermission("permission.myplugin")){
I think the old APi had no permission other then op and default and only for commands. That's why I think old API permission plugins only block commands.
The old API doesn't have permission. The so-called permissions are just isOp and isBanned. Commands are things added by permission plugin developers.