Users with "administer users" permissions can manage users that have a more privileged role

Let's say you have an "administrator" role (super-admin role) and a "sub-administrator" role. The "sub-administrator" role should be allowed to assign any role except for "administrator". Well, give them the ability to assign roles at all, you need to also give them the "administer users" permission. But this permission allows them to edit/delete all users (except user 1).... so while they wouldn't be able to remove the "administrator" role from other users, they could easily just edit their username or password or delete their account instead.

At the very least, I think a prominent warning should be displayed about this, both on the module info page and the README.