In reply to Jon Schroeder.

WooCommerce REST API uses read_private_posts capability (editors+ with this capability can view all revisions) so is not affected.

Since WC doesn't actually use revisions for products or orders, we're going to add a small patch to deny revision access anyway. That will also prevent access if someone giving read_private_posts access to other user roles. See https://github.com/woothemes/woocommerce/pull/7931