Yes, I have just tried this on my test site (41fb4a3ca0), and it’s behaving in an unexpected way.
Expected: Unticking reply or create on the security settings (and saving) should update the security settings.
- Edit category → Security
- Untick ‘create’ for everyone (and save)
- Refresh page
- Reverted to previous ‘all options ticked’
Adding a second group also behaved unexpectedly
- Add another group (along with ‘everyone’)
- Untick create for ‘everyone’ (and save)
- Everyone group has been removed
I think this may be a bug.