It seems like the permissions control on rollbacks is a bit flawed. If a wiki is set up to allow regular user's to rollback pages, they can rollback protected pages, although they can't edit them, which can be almost as disruptive as vandalism.
Was this functionality intentional? I would have assumed that if a user didn't have the rights to edit a page, they wouldn't be able to roll it back.
Travis