That is exactly why we want a generic publish/moderate admin seperate from the install/paramter admin privilege.
Having a generic privilege at this level will cover almost all cases we can think of and simplify the permissions across most packages.