I just checked and we have Maximum Input Variables set to 1000 (not sure if that is the setting that this relates to).

That would be the culprit. Increase it to 3000 and your issue should likely go away. I'm surprised you're not seeing this elsewhere. You surely should've been hitting input limits with Joomla global configuration due to the number of permissions combined with large number of usergroups.

Believe I know why. CBSubs has 15 permissions. Joomla global configuration only has 11. That's 1 input per permission per usergroup. I'm not sure anything else has as many permissions as CBSubs. Example as follows of what's happening.

20 Usergroups
CBSubs: 300 inputs
Joomla: 220 inputs

It just continues to grow the more usergroups you have. The only solution really is to just increase your input limit. Pretty sure the new recommended default these days is 3000 anyway and it's unlikely any of our plugins would hit that limit.

With all these great options and features comes lots of potential for things getting either messed up or just confusing.

Yeah, just an unfortunate side effect to having flexibility. We have to cover as many usecases as we can, which means tons of parameters. We're reviewing potential solutions for CB 3.0 to make the process easier (possibly backend modes like Basic and Advanced to limit what is shown). We've at least reduced this a little bit by adapting the rule that design parameters (basically templates) should not exist and should in fact just be a part of the templates.

BTW ... you might want to put a 'recommended configuration' for CBSubs to increase that max_input_vars (if people have a lot of user groups) - just to prevent this in the future.

Normal circumstances would never hit this issue. You'd need something like 95 usergroups to hit that limit, which is an extremely large number of usergroups for an install. I really don't recommend more than 30 as ACL is used everywhere throughout Joomla and the more you have the more of a performance hit you take on every single page. Typically repurposing the defaults +5 or so more usergroups should cover more usecases.