Good question, this is then the same as it is in LS, it is allowed if user has right for action under one of the locations.

User specifies locations in ContentService::createContent( $contentStruct, array $locationsStructs ); and the permissions are also checked there. So this should occur only if the permissions are changed between draft creation and publishing.