One thing to check, you see that "Like" link there.
Right click it and click "Copy link address" (or similar, depending on browser).
Now paste that into your browser's address bar, and change the "like" bit at the end of the link to "comment" and go to that address, e.g.
Change:
https://xenforo.com/community/profile-posts/26312/like
To:
https://xenforo.com/community/profile-posts/26312/comment
Do they get an error when going to that URL? If so, what is it? Or do they get a comment box?
Just trying to rule out some template weirdness and verify it is actually a permission error.