I don’t think that automatically ensures the email address is verified before Admin approval is requested.
As admin I must (i) manually force email verification for each user, or (ii) check and approve the user.
In my case (ii) is a bit of work (checking a non-disclosure agreement is in place for that user) and I would like to avoid it if the email isn’t genuine.
Practically, (ii) is a bit slicker from the new-user perspective, because s/he doesn’t have two wait periods (one before email activation is forced, then before approval is granted).