Employee with "Can edit group membership" can move clients between offices with no need for a permission

Employees with "Can edit group membership" can move clients between offices without the need for the "Can edit office membership" rule

Repro:
1-remove the "Can edit office membership" from the users permission
2-search for a client
3-click on edit branch membership
4-permission works
5-workaround is to add group membership
6-enter a group name in another office
7-join group

you can find that the client has been moved to the other office without the need for the permission to do that

Expected result:
employees with no permission to edit office membership, should not be able to change the office_id for any client even by using the edit group membership