Apple App Store Connect has this issue for example. If you remove or downgrade someone from the store they retain access for however long... and they keep the ability to do destructive actions like remove or change the permissions of other users, at least they used to until a year or so ago when I last checked. They closed my security report as "by design" btw.