I just discovered that, depending on the module weights, users can create nodes with "restricted" vocabulary terms if they feed the terms through the prepopulate module. (The prepopulate module allows default form field values to be "pre-populated" by embedding them in the URL query string for the add-node page.)
However, I don't consider this to be a bug -- this is a feature that makes the vocabulary permissions module much more powerful.
First, I restricted a "categorization" vocabulary with vocabulary permissions. Then, I created customized links to the add-node page with the "categorization" term already in place. The user cannot see or edit the preloaded categorization term, but it is silently added to the node.
This allows me to keep track of where and how the new node was created. There is no other module that I can find that gives me this capability.
--- My feature request---
To get the behavior that I want, the vocabulary permissions module weight must be changed so it is HIGHER than the prepopulate module weight. I'm either looking for a less hackish way to toggle this behavior, or I want the current behavior to be documented so it doesn't unexpectedly change in the future.