Steps to reproduce: make yourself a bureaucrat on beta dewiki and visit https://de.wikipedia.beta.wmflabs.org/wiki/Spezial:Benutzerrechte
You'll see temporary user listed as a normal group that bureaucrats can check or uncheck. I see it locally as well, so it isn't coming from site config.
See https://www.mediawiki.org/wiki/Manual:$wgImplicitGroups
Note if we keep the "named" group (T355741: 'named' user group is pointless) it should not be assignable too.
Change #1047940 had a related patch set uploaded (by Tchanders; author: Tchanders):
[mediawiki/core@master] Add 'temp' user group to $wgImplicitGroups
The patch doesn't add the 'named' group to $wgImplicitGroups, since it should be removed instead.
Change #1047945 had a related patch set uploaded (by Tchanders; author: Tchanders):
[operations/mediawiki-config@master] Add 'temp' user group to $wgImplicitGroups if temp accounts are enabled
Change #1047945 merged by jenkins-bot:
[operations/mediawiki-config@master] Add 'temp' user group to $wgImplicitGroups if temp accounts are enabled
I'll close this task, since the problem is fixed. We can consider changing the default $wgImplicitGroups as separate work for the future (once temp accounts are enabled by default), separate from this task.