I guess that EXECUTE privilege on DBMS_STATS Oracle DB package is granted to PUBLIC. if yes, that is the reason why the new user test is also able to gather schema stats using the package.