I am sure this has been the behavior of phpBB probably almost forever, but when a user registers they are put in both the newly registered users group and the registered users group. When they meet the criteria for being a registered user they are removed automatically from the newly registered users group and then the registered users group permissions apply instead.
Except this approach has some unexpected consequences, allowing newly registered users to perhaps have create new topic permissions because their permission is set to NO for this permission instead of NEVER, and the registered users group has this permission by default. I think it's a much better approach to not put a user into the registered users group at all until they meet the criteria for being a registered user. Or perhaps the default permission in these cases should be NEVER instead of NO for the newly registered users. Anyhow, when you look at the underlying data, it sure is confusing!
This blog post shows the unintended consequence of this approach (see bottom of page).