User un-checked the Allow approve my entries and Allow to approve entry options under Time Entry and Expense Entry when customizing a security profile for employees. However, they are still able to approve their time and expense entries.
It seems that you have auto-approval set for time and expenses. The employees are not approving the entries, they are getting approved because of the auto-approve rules that can be set at the project, employee or global level. These rules automatically approve the time and expenses at the time of their creation and there is no role of security in this. Check out these articles for more information on setting up auto-approval for time and expenses:
Note: Because the auto approval process approves the entries when they are created, the submittal process no longer applies to them.