This isn't the only case where Github deletes more than one would hope. If you require 2fa for an organization, instead of simply locking out users that don't have 2fa enabled until they enable it, it removes them from the organization, and you have to re-invite them to add them back. Fortunately, it does seem to remember the groups and permissions they had when you add them back ... sometimes.