I've been administering JIRA for almost 10 years now, and despite the hundreds of little frustrations I run into on a daily basis, I really try hard not to jump on JAC and get feisty - I get that there's a million different priorities pulling at these products, and you can only fit so many hours in the day.
However, I have to admit it gets really hard to give you the benefit of the doubt when I see that basic administrative features like this don't exist. I understand that developing sexy front-end things bring users through your door, but ultimately the people who make sure those users have a good experience (and thus continue to pay the bills) are the administrators, who generally have more important things to do than hand-remove users from groups.
I shouldn't need to do a rain dance, or work through API's, or futz with SQL to manage user groups. I should be able to see a list, check some boxes, and hit a button. I am going to say "it's 2017, get your act together" but honestly 2012 or 2008 would work just as well.
We get attacks on a regular base. I can recommend to enabled Captchas. Feature would be handy though.