I found out the root reason behind orphan authorization profiles

If you put a deleted role together with a normal role in a transport order, then SAP gets confused and don't delete the profiles of the deleted role. The role gets deleted but the profiles got stuck in the user master record as a orphan profiles. PFUD can't detect this orphan profiles because is role-based.