Users without required role showing in Members overview

In a role-based access FCOM setup WP users that do not have the required role are blocked from accessing the community, but when they try to access the community portal, they are immediately added as a member and shown in the global members list. This is visible to all other members that have access.

Cause
This is caused by the call to syncXProfile() in User.php. This ultimately calls $xprofile = XProfile::create($data); and since there is nothing set regarding the 'status' property it defaults to 'active'.

The current setup requires $xprofile data to be available (and create it if it isn't there) to enable the Helper::canAccessPortal() call that is needed to check for role-based access.

Effect
This creates the unintended consequence of leaking the username and display name to all members that have the required role into the global members list (at [base]/members).

Reason why this needs a fix
This is impossible to solve even with custom coding, since there is no hook that is fired after a xprofile is created. If you'd add something like do_action('fluent_community/xprofile_created', $xprofile); we could at least add our own code to check for unwanted additions and set their status to pending.

Custom code attempt to try
I tried to do it on-the-fly when calling the global members list, gist here, but since it also loads with AJAX the PHP code is left untouched until a full refresh. It works, but only on full refresh.
Anyone that wants to extend or build on this, please feel free. I couldn't find any documentation on the API to fix this. And quite frankly, this needs to be addressed in the core plugin, right after creating the profile and setting the status to something sensible.