Able to change tags on resource group when using --deny-settings-mode 'denyWriteAndDelete'

**Describe the bug**
I have a bicep file that deploy's two resource groups and in those resource groups a storage account. On the stack deployment we specify --deny-settings-mode 'denyWriteAndDelete'. When we try to update the tags on the resources it does not work as expected but when we alter the tags on the resource groups within the stacks it is possible.

Would like to know if this is by design, known limitation or a bug.

**To Reproduce**
Steps to reproduce the behavior:
1. Create a bicep file with a resource group in it.
2. Deploy as a stack this is the code we used
`az stack sub create --name 'stack-demo-02'
--template-file '.\demo-02\main.bicep'
--parameters '.\demo-02\main-param.bicepparam'
--location 'westeurope'
--deny-settings-mode 'denyWriteAndDelete'
--deny-settings-apply-to-child-scopes `

4. Try altering the tags on the resource group.
5. The tags are updated on the resource group.

**Expected behavior**
I would expect that I'm disallowed to update the tags