The confusion comes from treating trust levels as groups instead of as “levels”. It’s semantically clear that if a person has a certain trust level, they also have lower trust levels. Unless you understand the internal implementation, it’s not clear that if a user is “in” a trust level group, they are also in lower trust level groups.
It would probably be more trouble than it’s worth, but it would be clearer if these types of settings were split into two settings:
approve unless trust level(defaults to TL0)approve unless groups(defaults to “everyone”)
The default values of the current setting are appropriate for most sites, so I doubt the setting gets adjusted very often.