Yes, you are right, it also can be the meaning. And "They are not allowed to paint" as well, but this last heavily depends on the context of the discussion, the one above is the most frequent meaning.

You're getting confused by two different English senses of the phrase "can't paint".

In English, "I/they can't paint" is more naturally understood to mean "I/they don't know how to paint", so it's a better translation of "nem tudok/nak festeni". You are correct that in certain contexts, "can't" also means not permitted, but generally that context would be specified - "you can't paint here" or (speaking to a small child) "you can't paint until you've finished your breakfast". In these contexts, yes, festhetnek would be better (at least to my limited understanding).