Confirmed with VMware that it is a bug in their SDK. Whenever we add a new SCSI Controller to a powered on VM, the API starts failing with GuestPermissionDenied error. The issue is on server side, so chaning the API version does not help.
The issue is fixed in ESXi 5.0 u2 but not in ESXi 5.1