If I have a role with inventory:group:read and I remove that permission, click "Add permission" I can add a inventory:group:read to that role without assigning a group to it.

This will allow permission to have 0 resource definitions

Non org admin user with that role can access a list of all groups in the group filter in apps when user has inventory:host:read of only "ungrouped systems"

Affects all apps with group filter