I think the permissions to manage roles can now be delegated too, so this is no longer true?