Does Topic level security not supercede story level security?

I wanted to create an admin topic area for myself and my story admins to be able to discuss site ideas without the general public seeing the posts. I created my topic and set the security so that Members and Anonymous did not have read rights. I then created a test post and left the default read rights (checked) for Members and Anonymous and the post still displays.

Is this by design?