It doesn't get saved which is good. So only the admin panel has this "bug", where you can add the same user multiple times, but it gets removed once you save the group and reload your tab. So nothing critical.
Disabling a particular Navigation doesn't prevent the user to browse its route
As an admin disable the navigation, let's say, Users.
Open an Incognito window and the Users icon is not displayed. Good enough! In the URL bar, type localhost:4567/users and the users page is displayed. In fact, the user should not be able to browse the route even.
These are available in other places. For instance, you can "Hide user list and data from guests" in ACP -> Settings -> User