Comment # 4 on bug 958151 from Ludwig Nussel

I have no concrete case. I ran into this when investigating the offline updates
feature gnome tried to sneak in. You can test it by removing some sysuser and
messing with the time stamps of /etc/.updated and /usr.

However, your solution does not make sure changes to aaa_base are inherited by
systemd. I think it would be a  better idea to generate basic.conf from
/var/adm/fillup-templates/passwd.aaa_base