Users able to publish any content regardless of permissons via CMF's 'Update Options'.

I absolutely could be missing something, but I've noticed that I can create a role, give it the 'filter and manage site content' permission, explicitly give it no access to a content type (e.g. 'Page') in the node module section of permissions, but still find that a user in this role can publish and unpublish page content (any content, really) via CMF's 'Update Options.' The user in this role can see all content in the list (as covered in other issues that have been submitted), but he is unable to edit or delete. No such restriction seems to apply to publishing and unpublishing. Am I misunderstanding how this works?

Thanks in advance for any info.