We kinda got around this by changing adding some permissions to civizualise.xml:
<access_arguments>access CiviCRM, view all contacts</access_arguments>
Not as good as the proper ACLs, but works ok. As JohnFF says, civizualise uses direct SQL so I imagine ACLs wouldn't be an easy thing to add.