Group membership is applied only when explicitly claimed for the userinfo

It makes sense for most case, but it's not the only way to get groups in more exotic use cases:

• it could be part of the id token claim
• it could be sent by the provider without any explicit claim