Database privileges are not enforced if the user has the SECURITY privilege or is the DBA of the current database.

The GRANT statement can be executed by a user who is either the owner of the target object, or has been granted permission (using WITH GRANT OPTION) to use the statement on the specific target object by another user.