org.apache.jackrabbit.oak.security.authorization.restriction.PrincipalRestrictionProvider#writeRestrictions sems too contain useless code right here:
The restrictions set is copied to a new HashSet and then some elements are removed from the new set. After that, the new set seems to be never used again.
The change was introduced by OAK-7944. Before that, the elements were removed from the restrictions set itself and not from the copy.
OAK-7944 only changed the Iteration-Logic, the creation of the new, temporary set was acutally introduced in OAK-758: https://github.com/apache/jackrabbit-oak/commit/645533f1db898b2e9332385cf50ee3feae0da5ce#diff-45fef5680c5074709fba3b2187330e60R86