Every call to hasPermission does $roles = \Drupal::entityManager()->getStorageController('user_role')->loadMultiple($this->getRoles()); for both logged in users and anonymous users.
I don't think roles changes mid request should not affect the result of hasPermission().
Anon frontpage get comparison of UserSession::hasPermission()