I've tested this on a vanilla Redmine (3.4):

Steps to reproduce, as admin:

Setup:

• Set 2 new roles with add/edit issues permission. We have: Role A, Role B
• Set 1 new Tracker: Tracker A

• Set 3 new statuses: Status A, Status B, Status C

• Define a Workflow for Role A, Tracker A with the following: All transitions are checked between Status A, Status B. Transitions to and from Status C are NOT checked.

• Define a Workflow for Role B, Tracker A with the following: All transitions are checked between Status A, Status B, Status C.

Correct case:

• As an admin, or as a user with Role A AND Role B, go to the New issues form, and for tracker, choose "Tracker A"

• In the "Status" dropdown, Status A, Status B and Status C are shown

Incorrect case:

• As an admin, remove the add/edit issues permission for Role B

• As an admin, or as a user with Role A AND Role B, go to the New issues form, and for tracker, choose "Tracker A"

Observed:

• In the "Status" dropdown, Status A, Status B and Status C are shown

Expected:

• In the "Status" dropdown, Status A and Status B are shown

Reasons why this happens:

• When we uncheck the permission add/edit issues from a Role, the WorkflowRules are kept in base.
• In the method used to get the new statuses allowed, we don't filter out roles which are not allowed to add/edit issues, hence still reading the WorkflowRules above.

See details below

Details:

https://github.com/redmine/redmine/blob/e8bc1dbaa80dd714254da9c19e4ffaae4fbf9736/app/models/issue.rb#L988
https://github.com/redmine/redmine/blob/d105365e06eddfdd66406c56b5f45dba2fda6769/app/models/issue_status.rb#L66

Options to solve the problem:

• Delete the WorkflowRules associated with the role when add/edit issues permission is unchecked (maybe too destructive)
• Always filter (see links above) on roles for which the method @consider_workflow?@ returns true (seems the simplest)