Seems like the default-roles-* composite role gets assigned to new users rather than the roles contained within this composite role.

How is one supposed to then remove a role for a specific user if it is in this composite role?

The documentation states that "Default Roles" defines the roles assigned to new users but this isn't what seems to happen the actual default-roles-* composite role is assigned to new users which is quite different and much more limiting.