I figure a site admin should at least be able to see them.
that's one of the big changes between Group module versions.
See here also: https://www.drupal.org/project/group/issues/3315050 💬 Sitewide Administrator permissions not working Closed: works as designed
anthonycamomile → created an issue.
I think that #3 above is correct.
"As an example: The Group module does not check for regular Drupal permissions. Instead, it has its own permission layer where access is checked versus group types when you are or aren't a member (group_outsider and group_insider scopes) and against individual memberships (group_individual)."
Essentially, the whole permissions thing was reworked in Group version 2. See also: https://www.drupal.org/project/group/issues/3315050 💬 Sitewide Administrator permissions not working Closed: works as designed