Hmmm. While the ACL issue is probably a bug, I think you've hit on a usage case which simply won't work.
Remember that copied lists sit on the same underlying MySQL table(s). When you change a join element from a single select option (like dropdown) to a multiselect one (like checkbox), this is actually making a significant change to the way the data is stored. In 'dropdown', we store a single FK value in your main table, pointing to the key you chose for the table you are joining to.
When you change the type to 'checkbox', we actually then create a many-to-many linkage table, between your main table and the joined table. We no longer store the selections in the element's main table field (as a single field obviously can't store multiple selected foreign keys to multiple related rows). Rather, we then start managing entries in the linkage table, with two FK's, pointing to the parent row in the main table, and the selected row in the joined table.
So ... you've ended up trying to use totally different ways of managing joined data, on the same underlying table. You've come up with a usage case we hadn't anticipated, and we'll have to add some defensive coding to prevent this.
But like I said, the checkbox vs dropdown issue is unrelated to the ACL issue you described, which I'll take a look at.
-- hugh