In Directory Server 5.2 ACIs on the root DSE had base scope. In Directory Server 6.3, ACIs on the root DSE have global scope by default, equivalent to targetscope="subtree".
To reproduce the same behavior as Directory Server 5.2, add targetscope="base" to ACIs on the root DSE. If you use dsmig to migrate the configuration, this is done automatically.