Roles without "assign access to nodes" permission still see "Access" fieldset on create node form

I have a role called "consultant" that does not have the "assign access to nodes" permission. Yet, when they create nodes, they can see the Access fieldset and can assign access. Is there any way to hide this fieldset for roles without the "assign access" permission, or is this a bug?