A WordPress multi-site installation, permanently retains the “site administrators can add users” option once changed which might allow authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an “add” action after a temporary change.
Update WordPress.