I don't know for sure, but I would think that this is the desired behavior, since Symbolics ACLs are good for protection from network access only, and it's documented that anyone logged into a file server can access anything in its file system. Hence, allowing remote login onto a "secure" server would effectively render ACLs useless.