Ability to promote parent approval unit without ownership in children

Summary: We have a client who has approval groups assigned as owners to approval units (base entities, in this case). A test user is assigned to all for the base entities (approval units), but one, and also is assigned to the group for the parent entity/approval unit. He was able to promote the parent approval unit, but none of the children were promoted.

For example, user is in the assigned group for Parent AU, Child AU1, Child AU2, but not Child AU3. He promoted Parent AU to the next level, but still has write access to Children AU1 and AU2. How is this possible? Not being assigned to the group of owners of AU3, the promotion should have failed, but it did not. What are we missing?