Private projects allow commits from group members with Owner permission

Hello, I have a group project which is crated as Private (Project access must be granted explicitly for each user.). All members in the group have Owner permission because they need to be able to create projects as they see fit.

Group members which are not members of the private project can push to the master branch which is protected. I was expecting this to not be the case.