If a user has 'administer content types' permission, but not access to a particular private field, then they can edit that field but not its privacy settings.
They also can't set the default value, which is presumably desired behaviour.
However, they see the "The default value for this field, used when creating new content" UI help text in a blank fieldset.
Closed: outdated
1.0
User interface