Moveable Type has a logical security hierarchy: the system administrator has permissions to change things on a system level and a blog administrator has permissions to change things on a blog level.
Nearly...
A blog administrator can change the local directory on the web server machine where his blog is published to. So he could (accidentally, of course) change it some other part of the web server hierarchy, trashing someone else's blog, for example.
Surely setting the local directory for a blog is a system administrator task?
I filed a bug report with a link to this post.