Grant deny permission stacking
This is documented behavior provided for backwards compatibility. Documentation excerpt:


  Caution A table-level DENY does not take precedence over a
  column-level GRANT. This inconsistency in the permissions hierarchy
  has been preserved for backward compatibility.