ModuleWrapper is a hack that I wish no-one would use. The security model is based on both page and module permissions so security check methods in the base page verify if the module exists on the page but with modulewrapper there is no valid pageid passed to the edit page.
The solution is to either put the feature instance directly on a private page without modulewrapper and use that page to edit it, or else change the logic in your edit page to allow editing even though the base page methods says it should not be allowed, ie change it to only check the module edit permissions without verifying that the pageid is valid.
Hope that helps,
Joe