See the text above the permissons? It comes from the permission_tooltip template and is hidden by default via CSS. It talks about a "Deny" value, but I haven't found a "Deny" value in XenForo. I assume this is what the original permissons page in the ACP was supposed to look like, but has since been deprecated. But then again, why not remove it?