We noticed an issue where changing a top level category's permissions (ie from Private to Internal) did not update any of the child categories or articles. We had to manually change each category and article's permissions.
We had assumed that any child categories or articles would inherit the permissions of the parent category in a top-down manner.