Yep, there's several sections of the site that allow the Operator status to override the permissions. Even the page visibility is overridden by being logged into a Operator account.

As @Wise suggested, it's best to have two accounts entirely for testing your sites permissions. Have your test account remain as a non-operator (this is default) and create profiles with differing roles on that non-operator account. This makes testing all the different permissions a breeze.