Just in general I've noticed you have to do that ☝️ for basically any user.
I have users who help test some stuff in RP and when the RP environment is fresh, they have all their roles and their EE record looks normal like they should be able to login. But they're not able to do so until I remove the role(s), save, add them back, save.
Kind of annoying NetSuite doesn't just blow the roles away from users if they're not going to work like it does with a Sandbox refresh.