Binlog filter does not filter SQL which updates mysql.user table

A client wants to prevent user and user privilege statements from replicating to an offsite replica.
This replica replicates via a binlog router.

The issue is important for the client as they want to use the offsite replica with different users and privileges compared to their on-premise databases and is blocking our ability to fulfil their request. (see support ticket).

I setup an binlog filter to exclude mysql.user statements but the filter does not exclude the create user, grant statements from running via replication on the offsite replica

https://mariadb.com/kb/en/mariadb-maxscale-2208-binlog-filter/

– based on documentation
– exclude/ignore any statements going to mysql.user

[BinlogFilter]

type=filter

module=binlogfilter

exclude=/mysql[.]user/

When I reviewed the binlog there is no mention of a table (mysql.user) when those grant statements are run.