User wants all Core users to have the same set of security permissions, but on trying to assign the same security profile to all, Core displays the following message:
Security Profile cannot be updated as we require at least one user with full access security permission.
This is the expected behavior in Core. It requires at least one user (the owner) to have the Full Access security permission so that if any changes are to be done in the future in any module, at least one user has the requisite permissions to do so. For example, if you were to assign the Time and Expense security profile to all users, there would be no user left with the ability to modify the security permissions in the future. This is why Core does not allow it and requires the owner account to always have full access. Check the Core Help for more on security.