Hi Michael,
I've updated the page here tomake it a little more clear.
http://www.mojoportal.com/rolesandpermissions.aspx
Administrators can view everything regarldess of whether the role for Administrators is checked, so there is generally no need to check that role as allowed. The only special case where it is useful is if you want to create a page that the Content Administrators cannot edit. If you explicitly set the view permissions to only the Administrators role, then no-one else can see it including Content Administrators. So we purposely don't check it by default and checking it alone has special meaning and purpose.
b. You are correct, I just reviewed the code and I consider it a bug, because some of the security settings were editable by Content Administrators. I have fixed it in my copy so it will be fixed soon in svn trunk and in the next release. They will be able to set some things under security like Captcha settings.
Role Administrator can manage roles and role membership with some limitations as indicated in the document. He can see a link to the member list but actually it is possible to block his access to the page itself, he does not need that page to manage role membership. Who can view the member list is controlled by a config setting <add key="RolesThatCanViewMemberList" value="Authenticated Users" />
Hope it helps,
Joe