This is an API issue, easily reproducible with hammer:

Issuing the following command while specifying a hostgroup with 0 hosts results in Hammer printing out all hosts known to Foreman regardless of their hostgroup membership:

hammer -u admin -p password --csv host list --hostgroup 'Fedora Rendernodes'

If we run hammer with a hostgroup that contains at least 1 host, then only the hosts associated with that hostgroup are printed (the expected behaviour). For example this works as expected since "Avere Mounts" is not an empty group:

hammer -u admin -p password --csv host list --hostgroup 'Avere Mounts'

Note that in this case, 'Avere Mounts' is inside 'Fedora Rendernodes': "Fedora Rendernodes/Avere Mounts", but the behaviour still happens with hostgroups that have no subgroups.

Expected results:
I think the correct behaviour should be to not print anything since the hostgroup we asked for is empty.

Additional notes:
This bug was introduced with fixing http://projects.theforeman.org/issues/13775/, namely it's this line: https://github.com/theforeman/foreman/commit/8e81effcedafc539cbe3477b5565d9239f1f2f51#diff-6e62e9d287766aaa9c3d35e6dc3470a1R375