In T69145: editmyprivateinfo blocks confiirming email, Brad says:
what they need to do is not screw with the assignments for editmyoptions
and the other 'my' permissions at all.
As far as I can see, this guidance isn't documented anywhere. It should at least be noted in DefaultSettings.php and [[mw:Manual:User rights]].