Any user with the Site Member role is permitted to add content to Documents and Media and Asset Publisher portlets without any special roles. If we examine the Site Member role's permissions, we can see that no permissions are defined, and that the message This role does not have any permissions. is present.
It seems that the role permissions should be present in the UI (as they are active in the actual behavior) as detailed in documentlibrary.xml:
The problem seems to be that the actual permissions are not present in the Define Permissions panel, and instead is showing no permissions at all, which is not true.
With that being said, it seems like there is a disconnect between the UI and the actual permissions.
Steps to Reproduce
1. Start up Liferay DXP + DE-13
2. Access the Product Menu > Users > Roles
3. Click the Site Roles tab
4. Next to Site Members, click ⁝ > Define Permissions
No permissions are defined, despite the actual behavior where users can add and view assets on a site.
The defined permissions are visibly present in the UI.