Does not prevent access to activity stream

I am not sure if this is a 4.0 issue or not but I just tested out this plugin and was able to get full access to the activity stream which has forum post content from an unapproved user.

I hope this is just a bug. The next closest plugin I have (New User Approve) found ignores the registrants previously entered password and creates another crazy password which they will have to reset again.

I appreciate any feedback. Is this by design or a bug?

https://wordpress.org/plugins/bp-registration-options/