Config Exclude ignores user permissions related to the excluded module config

smashing the bug!
... by referring to the feature request that wants to achieve the same thing.

The issue here is not that this is a bug, but rather that this is a side effect of roles having dependencies on things that provide their permissions. But to solve it one can not only look at roles but any other configuration could suffer from the same effect.

For anyone who finds this: https://www.drupal.org/project/config_ignore → may be a better solution.