The mask entry is the ceiling for what named users and groups can actually use, so m::rx caps every named entry at read and execute even if one was granted write. Tighten the mask to block group access without deleting the entries themselves. The mask only limits named entries, never the file owner.
Looking for more? Search all 7,657 commands — works offline, in English or Spanish, and fixes typos.