Thanks to @cuccubus on Discord, there was a flaw where users that didn't have permission could still get player heads. Thank you very much!

Now, only OPs by default can use it, since the default permission for playerhead.give is set to op. You can change this still, if you'd like in luckperms or another permission managing plugin.