I am probably being silly but when you create a user upgrade purchasable through their CP, you can make xenforo automatically add them to a group but if that is not their default group then the permissions maintain from the default group they were already in, if you know what I mean. So how can I make it so the upgraded group becomes the dominant group and the permissions are taken from that group?
The primary / secondary usage of a group does not matter in terms of final permissions for a user. Normally everyone belongs to Registered as their primary. That group defines the base permissions common to all users. Any permissions that are not common should be changed to Not Set in the Registered group, then additional groups can be added which Allow those permissions.