On the tenant App Catalog site the group ReadOnlyAccessToTenantAdminSite has access. I'm not aware of having added this group myself. This looks like a recent change from Microsoft.
Google so far does not show any results for ReadOnlyAccessToTenantAdminSite.
Clicking this group shows:
Customers need to know what this account does and whether it can or should be used to grant users (e.g. guest users) access to certain SharePoint areas like the app catalog.
Domain Group
). Tried searching for it in M365 admin center, Azure AD as well as MS Docs>> No results.