The hierarchy question is a good question.
I think we should keep depending on site-wide permission as a mandatory setting, and use the group settings more as an "opt out" mechanism.
I do think we should explain it better in the UI, so when setting via cp/users/permissions it would be clear what is  going on.