In Jira, the ability to configure components is restricted to project administrators or individuals with higher-level permissions. If you hold the Administer Jira Global permission, you are granted the capability to create components, regardless of whether you possess the Administer Projects permission for a specific project.

configure-jira-components

And this seems to be the bug because the component works at project level Hence, we should have granual permission at project  level which can be used to restrict users to manage component, Global permission Administer Jira should not give rights to the user to create components 

Workaround:

In order to restrict users from creating the components in the project, we would recommend you restrict users from Administer Projects permission present at the project level and make sure that the user don't have the  Administer Jira Global permission