The default roles need to be removed from Group. Right now the option to pick a default role during group creation has been commented out for the UI, so it is not possible for a user to select one. However, the code needs to be refactored for this functionality to be removed in its entirety. A design session needs to be held to figure this out since it is highly complicated how all this works, and should be kept in mind during the security refactor for the next release.