The idea has always been that a port connects you to the thing above/outside of yourself, so when you are inside a process group it connects you to the parent process group, and when you are on the root canvas it connects you outside that root group to other instances.
This behavior existed well before NiFi's current multi-tenancy security model so it was not originally an issue, but you are correct that this creates a problem for letting tenants fully manage themselves.
This is something the Apache NiFi community may want to address in the future.