The Magyars took over a city belonging to an AI near my borders. So I quickly funneled money to them so that their relationship status towards me would be tolerant and they wouldn't attack me. A few turns later, they sailed over to one of my islands and immediately started ransacking an emblematic quarter I had built several eras ago, so I can't rebuild it. Is this a bug, or are they supposed to be able to do this?

Yeah, independ people's who will not attack you still ransack your outposts and districts, it's a known issue. The only workaround is to put scouts on top of buildings so they can't ransack it.

It's intended. Gotta post up guards. Also if you see themdoing it you can sometimes 'buy off' the ranscaking army.