[deleted] Restricting the View User List permission in this manner will restrict access as you described in the first case. The second is likely a bug. If you need guests to see profiles, you need to set View User List to Everyone.
The View User List permission is a bit of a misnomer because there is no built-in userlist for Flarum. It allows users to search for and view the profiles of other users, such as in the search bar, @mention feature, and clicking on their user page. It doesn't control the view of any page listing all members, fyi, that would require an extension like Flagrow User Directory.
