Yep, this is by design, and many topics over the matter
https://meta.discourse.org/search?q=category%20inherit&expanded=true
There is some discussion around adding some additional validation ensuring the child category meets the same security permissions as the parent though at Shouldn't a category be the mother of all subcategories?