Tried on win7-x86 with 7u21 and the below is the results (I think this is the same for 7u25):
1. remove deployment.properties files under both <deploy_user_home> and <deploy_sys_home>
jre-7u21-windows-i586.exe WEB_JAVA_SECURITY_LEVEL=VH
security level in JCP is VH

2. with <deploy_user_home>/deployment.properties containing deployment.security.level=HIGH
jre-7u21-windows-i586.exe WEB_JAVA_SECURITY_LEVEL=VH
security level in JCP is H

3. remove deployment.properties files under both <deploy_user_home> and <deploy_sys_home>
jre-7u21-windows-i586.exe WEB_JAVA_SECURITY_LEVEL=M
security level in JCP is H

4. remove deployment.properties files under both <deploy_user_home> and <deploy_sys_home>
jre-7u21-windows-i586.exe WEB_JAVA_SECURITY_LEVEL=M
security level in JCP is H

They look related to bugs below (though they may not be 100% match, I think the share same code logic more or less)
===========================
https://jbs.oracle.com/bugs/browse/JDK-8010990
https://jbs.oracle.com/bugs/browse/JDK-8010435
===========================

I guess is that the code is trying to set <deploy_sys_home>/deployment.properties to the value specified on command line, which however will be overridden by <deploy_user_home>/deployment.properties (even if it's locked)