User without capabilities able to assign roles

I have a user role which does not have any backwpup_* capabilities assigned to it, but is able to add and edit other users.

However, on the Edit User page, the Assign BackWPup Role select box is shown.

At best this is confusing for them, so it should not be shown to them if they don’t have the backwpup_settings capability.

Thanks