A fix can be implemented in bug_actiongroup.php, by adding the logic to check workflow for "case 'UP_STATUS'" as follows:

            case 'UP_STATUS':
                    if ( access_has_bug_level( config_get( 'update_bug_threshold' ), $t_bug_id ) ) {
                            $f_status = gpc_get_int( 'status' );

                            #fix: check workflow when update status
                            if ( FALSE == bug_check_workflow($t_status, $f_status ) ) {
                                    $t_failed_ids[$t_bug_id] = lang_get( 'bug_actiongroup_status' );
                                    break;
                            }
                            #end-fix

                            bug_set_field( $t_bug_id, 'status', $f_status );
                            etc....