Exactly.
Additionally the TSTCA check at the start of SA38 requests at least some authority for S_PROGRAM. But S_PROGRAM is suppressed for programs without groups and SUBMIT is not needed to start programs -> VARIANT is enough.
If you can start a transaction but the TSTCA check fails, then you are also informed that you are not authorized for the transaction as it makes no sense to continue (depending on how sensible the TSTCA is maintained..).
There is unfortunately no syntax check or input validation on it. So it sometimes contains nonsense.
Cheers,
Julius