Create ACL is lost when select ACL is dropped

If an object had both CREATE and SELECT privileges on the same user group, then if we were to drop the SELECT privilege, even the CREATE ACL corresponding to `---` is lost