It turns out it was the case. The call group is only evaluated for group pickup. For extension intercept, there is no check whatsoever. When combined with the fact that someone can add a BLF button on a polycom and see whenever a call comes in on a remote extension (and then press a single button to answer it), this is a pretty big concern.
I've modified our intercept.lua so that the following happens:
1) users not in a named group cannot intercept any calls
2) The intercept extension feature is now limited to extensions in the same call group.