Implicit rights represent actions granted to all users. They can be rate limited, but not revoked. This indicates that the authorizeXXX methods on Authority should return true for these rights unless a rate limit is hit, regardless of whether the user is blocked. Letting such checks fail for blocked users has caused bugs such as T350202 and T350117.
For reference, the current list of implicit rights defined by core is defined in PermissionManager:
private const CORE_IMPLICIT_RIGHTS = [ 'renderfile', 'renderfile-nonstandard', 'stashedit', 'stashbasehtml', 'mailpassword', 'changeemail', 'confirmemail', 'linkpurge', 'purge', ];
Extensions add to this list when they specify a rate limit for an action that is not also defined as a group permission.