User membership in groups defined as +mygroup aren't looked up group membership in /etc/groups. This was acknowledged by Volker Lendecke, and suggested that group might be picked up in network groups, but this directly contradicts documentation which explicitly states "A name starting with '+' is interpreted only by looking in the UNIX group database." So I guess there's a bug either in docs or the implementation.
Maybe it's a little confusing but technically the Unix group database is serviced by NSS and is not strictly the /etc/group file. I'll make the docs clearer.