initgroups is always done online even when a user has an active session in the system and therefore updating initgroups is not relly that important (most authentications are either sudo or lockscreen related and are not expected to really have any changes to the user group definition (and even if they did they would not apply to the existing session).

(Pam) Initgroups requests should be smarter and use the cache when a user session already exists on the system