I installed the Hide Dashboard plugin which hides everything but the profile editor page from subscribers. That is good enough.
I think that the fact that subscribers can see comments they shouldn’t is a security problem that should be fixed in the main program. Protected should mean protected. No one but an admin user should have access without the password.
