The code of Special:UserRights misleadingly implies that we're performing actions upon a User object, when in reality it could be a UserRightsProxy or a CentralAuthGroupMembershipProxy, which just happen to have the same functions. We should create a common interface for those functions and explicitly specify through documentation and type hinting that that interface is being used rather than blindly assuming User.
The real goal of this refactoring and cleanup is to ensure that bugs like T88505 don't happen again.