This is actually desired behavior and how it has always worked! If the minimum security is set to members (locked, for a personal account), you can't currently post an entry with a lower security without posting it and editing it. That's to keep a browser glitch or an accidental misclick from causing you to post something less secure than your desired minimum security.

To bypass it, as you note, post the entry and edit it after you post. We have a bug open to make it easier to override the minimum security at time of posting, but it will never be as simple as "change the drop-down", because when it used to behave like that on LJ (dropdown set to the desired minsecurity by default but changeable at the time of posting), loads of people accidentally posted things less secure than they wanted them to be, and when you're dealing with something like security it's better to default to the option that keeps people from accidentally exposing data.