Currently Role admins can add users to Content Admins role, but I agree it should be possible to restrict that and maybe should be restricted by default just as admins role is not allowed to be assigned except by other admins.
I've added an item in our project tracker for it.
Best,
Joe