User-specific permissions are classed under the "manage users" permission, so they would always be able to change their permissions via that, as they would need that admin permission to change a user's group. In general, changing a user's group would allow effectively arbitrary levels of access anyway though so I don't know if that's significant.