Access to parent Type allows access to child Type automatically

In one of our customers we created a Role, which allows access to Party, but this gives access to Organization as well; Organization extends Party meaning I can do an Organization.fetch using this Role. Is this expected behavior?

Yes, since Organizations are Parties, being able to access Party gives you access to all of its extension types.