Hi Pedro,
This is something which can't be acceptable.
Are you sure that this user is not getting the role search authorizations (for all roles) by any other roles or profiles.
There can't be any room for this to happen if you have restricted the user authorizations at the object level. I am already using the same way and I am sure others do as well.
This is the only way to restrict the users to search for the roles.
Hope you generated the role profile and did the user comparison post modifying/restricting the authorizations.
Try to log-off that user ID and log-in back and see if this works out.
Regards,
Ameet