Campaign
Your child level users are able to update parent level records.
This is working as designed. In workflows, the rights (unit access with geo and org unit) are applied when querying the target but not when updating the data (due to the design with the execution of bulk queries).
Working as designed.