Just checked. Yes, I take the permissions from the parent collection. AFAIRC I did that purposefully as that is how the CardDAV ACL works.
I'll have to improve that, but for now setting it to `\OCP\PERMISSION_UPDATE` *should* work.