yes, QAD by default gives permission to all users (*)
when you add new menu, so you need to use menu 36.3.10 Menu Security
to change that.
Also, note that menu security is top down,
i.e: you cannot give permission to a sub-menu, while its top menu/s are blocked
if you need to 'open' access for a sub-menu, for a certain user, you must
create it under non-blocked top menu