I'm unable to reproduce this (tried a few times on my machine.)
The only things I can think of are:
A) It's really a Futon issue that's being reported as a DB issue.
B) You are restarting CouchDB so quickly after updating the security objects that it doesn't have time to fsync. I've added a call to ensure_full_commit so that PUT to /db/_security will not return until after an fsync. I think this is a fine thing to do as setting the security will happen rarely, and the consequences of losing such an update due to power outage are greater than the consequences of losing a document update.
This was added in r918855 and backported to 0.11.x in r918856. Please update to the latest code and try to reproduce.
If no one is able to reproduce I will close this issue.