Currently as per design in D365 Finance and Operations ERP, there is nothing preventing a user from first level approval group to reassign a workflow that went to second level group for approval to themselves, since both user levels of same workflow have a common access point or privilege. This was noticed for Vendor name change workflow where we created two levels, say level I and level II in the same workflow with user X being part of level I and user Y being part of level II. Once user X approved it further went to user Y from level II for approval, however user X from level I can technically still reassign the level II approval to themselves and approve it thereby defeating the purpose of having a level II in the first place