Uploading same file does not check for file permissions?

Hi, thanks for the great module - I've nearly got it to production stage but have come across a possible bug?

I have my "Default File Permissions' set to "Role View Access" and the users can download but not delete the files someone else uploaded (using the right click options). However, with how the versioning is setup if a user downloads another user's file they appear to able to overwrite the original file by re-uploading with the same name and clicking: "Replace and delete original copy of ..."

Is this correct? Is there no File Permissions checking before allowing deleting and overwriting by a different user?

Please let me know as this is vital in my project