The ROLE_USER_NOAVATAR is given a never permission for the for the two u_masspm* permissions. It makes however more sense to assign a no so that this role doesn't remove this functionality as there isn't a reason for these rolls to get never assigned. The default never is assigned to ROLE_USER_NOPM and thats the only role that should assign never to pm permissions (out of the box)