CB

This is due to a Joomla bug which doesn't handle save properly (only halfways does so) when $user->params is untouched as a string and not as an array.

Bug in Joomla is in libraries/joomla/user/user.php in function bind:

if (array_key_exists('params', $array))
{
            $params = '';

$this->_params->loadArray($array['params']);

if (is_array($array['params']))
{
                $params = (string) $this->_params;
            }
            else
{
                $params = $array['params'];
            }

$this->params = $params;
        }

The line $this->_params->loadArray($array['params']);
should be pushed down in the case of $array['params'] being an array, and a separate line should be added for the other case.

That makes that a Joomla bug.

Workaround is to never pass an untouched string: either null or the params as an array, same as when saving in frontend with params enabled.