As @HartyeTech discovered, Salesforce fills in permissions based on an out-of-the-box profile.
However, it is not always the Standard User profile. I believe Salesforce selects a standard profile with a matching user license and applies that (with some specific selection of a given standard profile when there's more than one against the same license type, as is the case for Standard User).
For example, I have an "no CRUD/FLS" profile, i.e. one where the XML only defines accessible custom metadata types, custom settings, user permissions and layout assignments, based on the Customer Community license and the CRUD/FLS permissions given to this profile match those of the standard Customer Community User profile, not the Standard User.