It appears that this is not a bug. SecAccessControl provides protection for crypto operations (decryption, signature) with a private key. Object creation and deletion are not protected.

Hi Quinn It's more a security reason not allow files escaping the from the original device.