Yes, this is how the permissions system is currently designed, because granting connect, send and receive permissions is a much lower risk action than the other types of permissions that can be made subject to administrator consensus. Also an address with activate permissions is able to change these permissions, but not any others.