Yeah wtf, this is wrong. They should require explicitly permission before transferring ownership.