When a category has a subcategory, we ensure that no one who can see the subcategory cannot see the parent. However, we don't take into account the fact that, when no CategoryGroups exist, the default is that everyone has full permissions.