OK funny, nice hair…:-) That’s an interesting behavior and not what I’ve experienced. Are you using SharePoint or Project Server permissions mode? I assume from your comments that these are enterprise projects (not SharePoint task list projects). Do the permissions change if you then add them as a resource? Can they see the Project Summary web part on the home page? Now I originally assumed this was a Project Server on-premise install, but is it Project Online?
I hate to say this but (for on-premise) anyone who has direct access to any Project Server data (including a site that’s synchronized) then they require a CAL. It’s no longer only active users in Project Server. Off the top of my head I don’t know specifics for Project Online but I assume the same basic requirements.
Let me know what you think. I’d love to help and learn at the same time.