Unless I am missing something obvious there is no acl for com_categories.

Yes it is possible to set permissions on an individual category but there is no component level acl.

This means for example in com_content that categories can be created "on-the-fly" by any user who has permission to create an article and there is no way to prevent this from happening.

Seems very odd to me that com_categories is the only component that has no ACL