At the moment, if categorycode isn't hidden, you can self-register as a library staff member. That shouldn't be possible. At the moment, since permissions aren't assigned, they can't log in as a library staff member, but it's not a good look. Technically speaking, someone really clever could probably also do bad things with this. (Locally for many years we've provided a syspref to restrict the available categories.)
Hm, I think we never ran into this as we use a temporary patron category for the self registration instead of a regular one, which also enables to delete accounts that don't finish registration in the library after a while. But for libraries using a different workflow that seems to make sense.