"Preserve hidden grants" setting ignored

Problem/Motivation

I have my grants set up such that people who are allowed to edit my Event nodes can access the Grant tab, which only has "view" access for the "anonymous" user listed on it. Recently, when someone makes a node visible to anonymous, the view access for "authenticated" is getting removed, even though "Preserve hidden grants" is set in the system preferences at admin/config/people/nodeaccess. This has the effect of removing the events from the calendar after the user logs in.

From original summary, but no longer applicable:

Note that in many of these cases, the person who made the change is known to have full admin privs, however the Grant tab still only lists Anonymous on it. One theory is that something in checking that priv assumed that the admin user would have had all the other checkboxes when he really doesn't.

Steps to reproduce

See also: even more detailed steps → -- plus, steps for testing that disabling "preserve hidden grants" also works as designed.
@todo: copy the steps from that ^^ issue ( #3073621: Add test coverage for "Preserve hidden grants" option → ) into our skeleton/work-in-progress test file (#37).

1. (Prerequisite -- enable "preserve hidden grants" -- admin/config/people/nodeaccess)
2. On the nodeaccess settings page (admin/config/people/nodeaccess):
   1. ...check which roles are enabled in the "Allowed roles" fieldset;
   2. ...check which content types are enabled in the "Content type grant access" fieldset;
   3. ...pick a content type for which the "Grants" tab is enabled; and then,
   4. Expand the settings for that ^^ content type and grant some permissions to add/edit/delete to a role that is NOT enabled in the "Allowed roles" fieldset.
3. Rebuild permissions;
4. Log in with this role -- note that you are granted the permissions even though the role is unallowed or "hidden" in the grant form;
5. Now go on the grant form node/%/grant of a node for this content type and add some permissions to other roles or users (Notice only the roles in the allowed roles are listed there);
6. Rebuild permissions;
7. Log in with this role again and you loose the grants given by your role that was not shown or hidden in the form.