I think that it is the other way around.
New usergroups should be set to allow access to all cats. It is much more common on probally 99% of our product installs that people have access set to yes for most all groups except visitors.
At least given what I have seen in my time. Highly restricted sites are not as common.