Should DBAs also be acting as Security Administrators?
I have functioned as all the roles in the past. Small place, one server, 3 databases and I was the only IT. So I did it all; DBA, cabling, hardware, software, programming. It should be separated out, but if you don't have the manpower or the money, then combined roles is the only way to cover them all.