Is temporary role when using set password and direct login useless?

I want my users to set there password themselves upon registration and login immediatly (automatically).
I understood the "temporary" role was to be given to them until they confirm their email address by clicking on the URL sent to them and that will PREVENT them to have the Authenticated role before they have validated their email.

However it seems that this does not behave this way. The temporary roles is correctly assigned to them on registration and then removed on confirmation. But they also have the Authenticated role straight aftre registration...allowing them to post things on my site just like a normal user.

Is that a bug or is that the feature as you designed it?