This fell through the cracks, but I am honestly not sure what a reasonable fix is.
We could “ensure consistency” and run a job once in a while that removes people without access.
We could “hide the info” and not render the users without access that somehow are in a channel.
Before we do anything here we should decide on what our desired behavior is.