With the present ChangePrivileges tool design (syntax) users may only set privileges and cannot revoke them.
The present tool syntax used at the commandline or in scripting, does not offer the the user a 'revoke' option. This can be seen from the syntax below.
ChangePrivileges <in_dataset> <user> <SELECT | UPDATE | INSERT | DELETE>
On the dialog, leaving a checkbox unchecked does nothing. The tool does not recognize the implied revoke information and passes nothing to the tool for execution.
Users who wish to revoke privileges need to do so through the relational database management system (RDBMS) they have implemented to work with ArcSDE.