A Sub-Admin can never create another Sub-Admin, no matter what permissions they're given — this ability belongs only to the Main Admin, and helps prevent access from spreading beyond what you originally intended. You can come back and adjust any Sub-Admin's module privileges at any time by editing their account.