Its shouldnt be.. if you edit a dynamic user to hard set group membership the setting should remain.

That said, such users still have an "auto created" flag which newer versions of ACS probably use in order to seek out and destroy dynamic users.

Sounds like the safest way, as you've found, is to manually create.

Also worth noting with AD, the same user could end up with several accounts in ACS depending on whether how they entered their name:

DOMAIN/user

user

user@DOMAIN

Each would look different to ACS and you might get multiple accounts.

Worse still, if you are doing NAC/NAP you'll see ACS create a user record for each user for each NAP.