New role can change accounts with administrator roles also

I created a new role moderator and gave permission of just "Edit users with role authenticateduser" under Administer users by role permission.
The user is not able to cancel the administrator account at first (which is expected), but and moderator can block / unblock an user with role administrator.
Also, it could change the role of administrator accounts. By doing so they are able to cancel the account too.