The APIs were built mainly to populate the interface. If you look at the part of the UI that call populates, you see the users and groups who have permissions at the top, and users/groups who don’t below that:
And that’s what you’re seeing in the results from your call, users who have permissions, which are populated in the permissions array in the user object, and users who don’t, which are represented by an empty permissions array.
Note that a) this is an internal API, meaning you use it at your own risk because it’s not guaranteed to be stable between releases, and b) we are actively working on replacing the API.