On further research I found a lengthy and on-target discussion of this issue on the fedora bug tracker:
https://bugzilla.redhat.com/show_bug.cgi?id=1364332 tl;dr it’s expected behavior since /etc/security/limits.* is not used by systemd, and further the behavior of pam_limits with group-based limits can’t be reproduced in systemd. I would suggest at least that there’s a bug in documentation that says clearly and unequivocally that the /etc/security/limits.* is how limits are set in Debian... bg
