No, the Privacy Level shouldn't be automatically changed based on the Trusted List. The only case where we force a Privacy Level change should be when the person is set as living when they weren't before.
It's likely happening during the merge, like you say. When two profiles are merged, the Privacy Level of the profile with the more conservative Privacy Level is kept. For example, if a private profile is merged into a public profile, the profile becomes private.