Category > Security > Permission type > Author-only

I disagree, that is exactly what you described.

They just have to report it via email is literally the only difference – and that’s usually what you want anyways, as pretty much every company ever has a support@example.com or help@example.com address.