Hi Dan,
when the system gets upgraded SAP standard roles will be replaced and that is the reason why no customer should use these standard roles from SAP productively. These roles are meant to be templates that can be used to create own custom roles as a copy of them instead of building roles completely from scratch.
Your custom roles are not automatically affected by the upgrade. It would be a big pain for customers if SAP wouldchange automatically the content of roles during an upgrade, because business processes may then not work anymore. Therefore SAP provides step 2a and 2b in transaction SU25 in order to transfer the delta that changed in SU22 to your customer area in SU24. Performing step 2c in SU25 will check which roles are affected by the changes in SU24 that are coming from step 2a and 2b. You will get a list of roles where the role profile needs to be merged with your updated SU24.
This is the correct SAP standard way to update your custom roles after an upgrade. So your Basis team is wrong. But you can ask them if they know transaction SU25. Maybe they perform these tasks in the background to provide an excellent service and therefore they tell you, that all custom roles get automatically upgraded too. :-)
Step 1 in SU25 should only be performed after system setup in order to copy standard authorization proposals that are deliverd by SAP in SU22 to your customer area in SU24.
Best regards
Stefan