When using apply to children flag in repo group permission change prompt, RhodeCode only applied this to user groups if repository was private. Only thing that shouldn't be allowed is to change the DEFAULT user permission when repository is private.