Thanks @pfaffman for the rapid response!
Actually, it looks like this was just my dim-wittedness front and centre here.
The default behaviour of the import:file rake task (which invokes ImportExport::Importer) is to copy exactly the permissions over from the source Category. I only found this out from looking over the source code.
And it did exactly this. The reason my destination category didn’t have the permissions I had been hoping for was that I had forgotten to set those permissions correctly in the source! I was moving a category in an already private forum (entire forum is private so that category was See/Reply/Create to Everyone in there) into a more open forum (in which those posts needed to be in a secure category - See/Reply/Create for Admins only initially)
I agree - since Category import is something that can only really be done in the real live environment, one might want the permissions to default to admin-only until the import has been checked and everyone is satisfied it’s OK. Better that than spamming users with notifications about bulk imports.