Great finding. This is a BIG problem, I have tested and can confirm this issue (latest Blesta 3.4.3), this cannot, ever, never, happen on Domains On Domains people only have to have the option to Change "Terms" and not "Change Package"
I consider this as a BUG, because its not the intended way for Domains to Work.
I Will open a BUG post for this to be resolved