This is correct - there is no inheritance of category permissions. However, if a user cannot see the parent category, they cannot see any sub-categories due to the way the UI works. Showing a sub-category when the user can’t see the parent would cause all sorts of issues. I’m trying to find where @codinghorror previously clarified this…
Edit: So I couldn’t find a post by a Discourse dev in my quick searching, but I just tested this on my site and can confirm what I said above.
Two categories: Testing, and Testing Sub. Testing Sub has Testing as it’s parent category.
Testing has the following security Admin: Create, Reply, See
Testing Sub has the following security Admin: Create, Reply, See; everyone: Create, Reply, See
With those settings, I can confirm that non-admin users are not able to see either of those two categories.
Keep in mind that the critical setting here is see. If the Testing category had everyone: See, then Testing Sub would also be visible, even though everyone cannot post in Testing.