I think I understand what's happening. In RRC, the artifacts displayed within a module are actually referred to as "Module Artifacts", and even though they only appear as a pointer to the base artifact, they are actually distinct entities which contain distinct information such as comments and links which are separate from the base artifact. Because these Module Artifacts are distinct artifacts, the "Remove" operation within the Module is actually performing an under-the-covers delete on the Module Artifact (not the base artifact), which is most likely being prevented by the lack of delete permissions which you've specified.

I probably wouldn't disagree with you if you wanted to consider this as a defect, since it makes sense that Module Artifact removal should probably be considered as a distinct operation. It actually looks like a defect was recently created for something similar to this: 

User cannot remove artifact from module when the "Delete an artifact" permission is not granted (75399)

Mike Jaworski