Hy Kevin.

I think If you created the procedure in the name of .dbo.
After this you logged on by using a different user mybe "Kevin".
You eliminated the update permossion on the table for user "Kevin" but the
user can run the procedure.
When you deal with stored procedures keep in mind that SQL Server looks if
the owner of the procedure have the right to update it.

So if the dbo (or sa) have this right, the stored procedure works.

This is not a bug

I hope this will help you.

Marian Stirbescu