I can repro this even on 2.8.2, so this is a pretty old bug that nobody has noticed.
However - the permissions are indeed being saved correctly in the database.
The problem “only” seems to be that the user interface checks all checkboxes as soon as the security tab is loaded.