You are correct. It doesn't matter that departmental restrictions aren't in use, nor the security group settings - this was a straight program change with no options.

Perhaps it was too blunt, but we had some requests from other clients to make the department security as tight as possible.