Promoting IDT Universe Security Profiles

We are running BOB43, SP4, Patch 7 (soon to be Patch 13). I recently created one additional Business Security Profile for an IDT universe. I promoted the UNX, the Business Security Profile and the User Group to which the restriction is applied, from our DEV to Prod reporting area. After the promotion was complete, I noticed the user group associations for EXISTING Business Security Profiles in PROD were wiped out. The Business Security Profiles themselves were fine, but the user group assignments were removed.

What are the rules when promoting Security Profiles (Business or Data) for a universe? It looks like the entire set of Security Profiles must be promoted every time even when you only create a new one or make a modification to an existing one.