Turns out, that behaviour was a bug we introduced as part of the LDAP sync. It was squashed as part of #18298.