Question:

An admin configures the default Atomic Security of a state change action to Hide in the Object Lifecycle.  

On the individual record, the action is hidden as configured:
 

However, it is displayed when using a Bulk Action. Why is that?

Answer:

The bulk state change action does not verify the conditions for conditional user actions until completing the bulk action and displays actions that are not valid. Records that do not meet the specified conditions remain in their original state. The fail error notification is sent when performing bulk action on the records that do not satisfy the conditions.

Related Documentation:

Vault Help Documentation: Using Bulk Object Record Actions