According to https://github.com/redhat-cop/quay-operator/blob/0daa0d326ceffe066c7f80929b4146103bddd976/deploy/olm-catalog/quay/1.1.0/quay.v1.1.0.clusterserviceversion.yaml#L551-L561 we are giving the Quay Operator RBAC permissions to modify SCCs, against our general advice to partners/customers not to do so.

In OLM 4.5 you should be able to ship your own SCCs directly in the Operator bundle, eliminating the need to give this permission to the Operator itself. We should remove the RBAC permissions and use the 4.5 feature when it's available.