Is there some type of “duel security” when you create an NTFS namespace?

This question came about because when we set of DFS replication, it asked for permissions to be set. These permissions are share permissions, not NTFS permission. By changing the permission (NTFS or Share) on the folders in the DFSROOT folder, you can change both the NTFS and the Share permission after the DFS share has been created.