Hi, are you sure that the user isn't getting this from somewhere else?
Role 1 + Role 2 will (in your example) give display/03 all and change/02 only V, the authorisations will not combine to give change/02 for *. That is not how the authorisation concept (in ECC) works.