Merging two policies with conflicting settings.

Because these are both global settings you can't have a mix and match. Any time you merge policies you should review the resulting policy for potential problems. Our documentation on this is very old, but it appears that if either policy has staging enabled, staging will be enabled on the attack signatures in the new policy. Some decisions depend on which is the primary policy and which is the secondary, and it is not clear if the global blocking setting is one of these. I would not say that your findings are unexpected, though.