The user can't use the blogs though. The blogs is treated as high as well. I have confirmed this by going to the user's blogs tab (logged in as user) and clicking add blog entry at the bottom, giving me the no categories error unless I have high impact submission allowed.
You may be right about a bug actually, but I'm 99% sure it isn't 9.0.20, this release had a relatively small number of patches, and definitely nothing in the news library code.
This didn't occur when I had version 9.0.20
I think I can see where the issue is.
It may be it did go wrong in some patch release, but not the last one.
Issue was that it filtered by permissions on an EXISTING news cat, but not on a POTENTIAL news cat. So it worked once (for POTENTIAL) then failed.
I have added special case handling for existing self-owned blog cat.