The user's previous license exist on the ACS4 server, and since it is more permissive than the new license request, it is used instead.
Another way of thinking about this, is that ACS4 was not designed (and there will be lots of corner cases that will not work) to retroactively take away rights that have already been granted to the user. (if the user has already fulfilled and downloaded with a completely open license - then they can always uses that, and not the new more restrictive license if they want).
But if you want to go down that route, then you will need to look into removing the original transaction and license for the user from ACS4.
