I've had cases where I've released an add-on upgrade with a permission definition by mistake, but the next version does not have it. On upgrading to the latest version, the permission definition is not removed as expected.
Not really seeing how this can happen, nor can I reproduce it in testing. If you can point us in the direction of a couple of add-on version releases where the issue can be reproduced consistently we can do some further testing.
Deploy the add-on with a permissions.xml file, and then deploy a version without the permissions.xml file. Guess what, nothing deleted that old permissions.xml file. Can't believe that didn't click.
I think _data needs to be populated with each XML file, even if empty. Otherwise simply uploading files is not sufficient to remove removed items.
@Chris D because the XML files aren't version stamped with the add-on version, the installer is reusing the old permissions.xml file which wasn't removed when the add-on files where uploaded/merged. The is a legitimate permissions.xml file, it just is from the wrong version of the add-on.
All the FTP/SFTP upload clients I've used default to "merge" when a directory already exists in the destination and it is uploading a matching directory.
While technically not a bug, but something which can seriously complicate the ergonomic of updating add-ons.
I briefly had a moment where I thought we handled it, but, yeah, you're right, it's the old file getting left over in the file system that causes the problem. I twigged before you replied.