That is the way, in new category creation security access setting can be set to admins only not mods.
That is surprising, as default setting or someone changed that?