Exactly. This is because the keys of the authorizations are entered into the transport when you record the role and not when you release it.
But with 7.41 this has changed and you can also use "locks" on roles which are in transports which are not released yet, so that they cannot overtake each other in the import queues of upstream systems.
Big bummer for composite roles (may the fleas of a thousand camels infest their armpits...) is that a change to a single role locks all composites containing that single role until the tp is released, so you need "golden transports" or you need to transport in shorter intervals (not that that is all bad - I do that anyway).
I will see if I can find my notes on this, but probably Bernhard has lots of Post-It's on his monitor as well.. ;-)
Cheers,
Julius