With a user that was created with ALL privileges, but without WITH GRANT OPTION it is possible to create users, but not to GRANT them any privileges. So far, so good, but the error message coming back from GRANT is a bit confusing:

MariaDB [(none)]> create user testme2@localhost;

Query OK, 0 rows affected (0.002 sec)

MariaDB [(none)]> grant all on *.* to testme2@localhost REQUIRE ssl;

ERROR 1045 (28000): Access denied for user 'testme1'@'localhost' (using password: NO)

Getting back something like User 'testme1'@'localhost' is lacking GRANT OPTION would be way more clear than Access denied for user 'testme1'@'localhost' (using password: NO)