A really large amount of work goes into writing a security module like is included in x-pack. I don't think it would be reasonable for a person, or small team even, to spend the time to try to write something like it.
In the case of x-pack, most of the security module is in Elasticsearch (not in Kibana). So the data is actually protected instead of just blocked by Kibana. Kibana does requests to Elasticsearch as the logged in user and if it fails for security reasons then it mostly just passes that error to the user.
If you're using Kibana for a small startup or non-profit I think you might get a discount on the license.
I don't know if you're running it locally or on AWS perhaps, but if you're running it in the cloud you might consider switching to the Elastic Cloud solution which includes security.
Regards,
Lee