There should be third option when changing folder/document access/security rights, 'Apply the changes only to selected folder (subfolder wont inherit changes)'. If there are subfolders that inherit the access rights, the inheritable breaks and they don't inherit the new access rights.