That's the expected behavior - the "backup" role allows backup agents to run the PowerShell backup script from WFA's bin folder:
.\Backup.ps1 -User bu -Password bu -File c:\temp\wfa-backup.sql.gz
(unfortunately it seems this feature is broken in 2.0... - I've filed a ticket for this).