Not a bug. "demote-self" is the core permission that defines management menu access, on the premise that owners should always have the right of refusal. ... I guess it could be named slightly differently, though.