http://msdn.microsoft.com/en-us/library/aa369774(VS.85).aspx specifies that with the LockPermissions table (Permission element) the object receives an explicit security descriptor. However, with PermissionEx, this is not the case... it still inherits the ACL. I suggest adding an InheritSD or InheritACL attribute to PermissionEx, that defaults to no to match the behavior of the Permission element.
I plan to fix this and submit a patch myself, but want some feedback on the attribute name and default.
This is a feature request, so let's track it there instead of here. Also, let's have design discussions on wix-devs@lists.sourceforge.net mailing list. Easier than in a tracker.