incorrect contact assigment to services with passive checks

Describe the bug

I have a rather fancy logic of applying contacts or contact groups. The gist of it is as follows:

// service definitions
apply Service "whatever" { 
  (...)
  vars.notification.sms.extra_groups = [ "itdcr" ]
  (...)

  assign where host.address == "172.17.2.59"

}

and the notification code has something like this :

  if (service.vars.notification.sms.extra_groups) {
    user_groups += service.vars.notification.sms.extra_groups
}

Expected behavior

A passive check gets assigned the 'itdcr' contact group.

Actual behaviour

ALL services on host with that service get assigned the 'itdcr' contact group. I have no clue why this happens, i have observed the exact same behaviour with passive checks two years ago as well.

The passive check is the only that mentions the 'itdcr' user group in the entire icinga2 configuration.

Your Environment

• Version used (icinga2 --version):

icinga2 - The Icinga 2 network monitoring daemon (version: r2.13.3-1)

Copyright (c) 2012-2022 Icinga GmbH (https://icinga.com/)
License GPLv2+: GNU GPL version 2 or later <https://gnu.org/licenses/gpl2.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

System information:
  Platform: Debian GNU/Linux
  Platform version: 10 (buster)
  Kernel: Linux
  Kernel version: 4.19.0-8-amd64
  Architecture: x86_64

Build information:
  Compiler: GNU 8.3.0
  Build host: runner-hh8q3bz2-project-298-concurrent-0
  OpenSSL version: OpenSSL 1.1.1n  15 Mar 2022

Application information:

General paths:
  Config directory: /etc/icinga2
  Data directory: /var/lib/icinga2
  Log directory: /var/log/icinga2
  Cache directory: /var/cache/icinga2
  Spool directory: /var/spool/icinga2
  Run directory: /run/icinga2

Old paths (deprecated):
  Installation root: /usr
  Sysconf directory: /etc
  Run directory (base): /run
  Local state directory: /var

Internal paths:
  Package data directory: /usr/share/icinga2
  State path: /var/lib/icinga2/icinga2.state
  Modified attributes path: /var/lib/icinga2/modified-attributes.conf
  Objects path: /var/cache/icinga2/icinga2.debug
  Vars path: /var/cache/icinga2/icinga2.vars
  PID path: /run/icinga2/icinga2.pid

• Operating System and version: Debian 10.12
• Enabled features (icinga2 feature list):

Enabled features: api command compatlog graphite icingadb ido-mysql ido-pgsql livestatus mainlog statusdata syslog