Welcome to Meta 
I think you are right; the permission and the related setting aren’t included in the table.
The user_API_key_allowed_groups setting’s default is trust level 0. The admin and moderator groups cannot be removed from the setting. However, to limit permissions, admins can remove the trust level 0 group, which includes all users who signed up. Then only staff are allowed to use the user API. They can also add other groups to restrict access to specific groups.
