There are at least 3 default groups per mesh project (if not changed by customer). These groups were created even if they are empty (without any user). If you have to manage a larger number of mesh projects you will create a lot of empty groups if the default roles are not used. It might be easier to manage only the groups in the IAM system which are really used. An on-demand creation of the groups might be helpful then.