You are correct, however, in terms of the XML file and the mechanics behind how vB parses the xml permissions data into a datastore array, the order doesn't matter. As long as the bitfield value is valid (and 524288 is), you won't run into problems.

From the looks of this, the reason that particular permission is placed out of order is for readability purposes; both 2 and 524288 deal with thread viewing permissions.