We have some custom script (build earlier) that removes the roles and not the groups for user record.

Both of these are valid scenario that is why I have to check both.