What's the intended behaviour for permissions and changing of group type?

Picture this:

You're setting up a new group for your community, you're configuring its widgets, its applications, and you're going to put it "live", and doing so means that you're changing it from:

- Private (Unlisted)

to

- Public (Open Membership)

If you're particularly 'on the ball' you've already configured the default template permissions here:

Where for Private (unlisted) you do not have "read group" permissions for registered users, or for everyone/anonymous users (aka the public.

Great! You're ready to go live, you have changed your group to "Public (Open Membership)" and you're good to go.

Except, you're not. Someone is unhappy, and you need to change it back.

No worries, right? You can go to "Private (Unlisted)" and it'll reset the permissions, it'll remove those who have "read group" access, and it will be hidden from the public.

Well Then

For some reason they do not, at least not for me.

The 'everyone' and 'registered users' roles still have read access, nothing has been removed or denied. I'd be okay if 'members' still had it, because we haven't said to remove all members, but it appears it's not applying the global permission template to over-ride a 'permitted' to a 'denied'.

Is anyone else experiencing or seeing this, have I discovered a bug? I believe we're on 12.1.9.35025