Meaning Write at the org level will supersede READ at a stack level?

Yes - permissions are the union of what is provided at the organization level by default and what is provided at the stack level. If you want to lock things down by default, you'll want to have

READ

as the default for your org. /cc also @colossal-beach-47527 to keep me honest.

Yup, that is all correct.

👍