Well , it’s not really a bug. As @abitmore described, there is a legit reason for allowing it as far as the chain is concerned.
As mentioned above, it’s a client software issue to ensure that «incompatible» permissions are not set.
This is more like going out and leaving your house-keys inside the house. Doesn’t mean your door is buggy.