Short answer: yes, that’s how it is supposed to work.
Longer answer: The design of User Permissions is, in my opinion, dangerous, and they should generally be avoided if at all possible. If you absolutely need them, make sure the data you need is highly sensitive and audit your settings frequently.