At the moment, when sortable is turned on for a tree view, then that view is unfortunately already sorted by default (when one just opens the app); it should be as per JCR natural order instead, until one presses the sorting arrows. This is a bug.

Security app is sorted by default, by design. Only this should be driven by the defaultOrder property on the content-connector definition.

Meanwhile, users can accidentally be reordered via DND but you don't see it because it's sorted!!
Actually, when sorted, we should disable the drag-n-drop functionality altogether as it doesn't make sense anymore.