schema user able to alter user

Hi Team,

I have a question, is this a security flaw.

SCHEMA user is able to perform alter user. But why does a schema user in BW + HANA system able to perform alter user.

Ideally it shouldnt be right?

Granted roles are :

ABAP_ADMIN

ABAP_DEV

ABAP_READ

ABAP_SYS_REPO

DBA_COCKPIT

PUBLIC

TABLE_REDISTRIBUTION

USER

I am trying to understand as to how this is possible.