[Answered ]-DRF Custom Permission not blocking the view

It looks like you are mixing djangos class based views and the DRF views.
ListView is a class based view from django and NOT from DRF. It therefore does not allow to set permission_classes.

Check the docs to see how to use DRF api views.