This is working as designed.
Let me give you a context of what use case is this satisfying, if any identity has entitlement directly assigned from a source which means that no matter if that entitlement is now a part of a ROLE or Access Profile assigned to that identity. It still keeps it as it was assigned by the virtue of detection from source and not assigned via ROLE or AP.
So, in simple terms LCS change or not meeting ROLE criteria will only remove the accesses i.e. ROLES or AP and their underlying entitlements only if they were assigned to that Identity by the virtue of assignment of that respective Role or AP.
This same logic applies beyond entitlements, also to AP where they are also detected and if they are detected then LCS changes wont remove those AP’s.
You can refer this to deeper understand how Roles & AP will act based on certain transactions, beyond what I mentioned above.