The UserManagementType defines:
The Properties and Methods of the UserManagementType contain sensitive security related information and shall only be readable and callable by authorized administrators through an encrypted channel. The only exception is the ChangePassword Method. It requires an encrypted channel but it can be called by the Session user if the user token type for the Session is not USERNAME.

The nodeset makes the properties PasswordLength, PasswordOptions, PasswordRestrictions readable to Anonymous.

The nodeset makes more sense since the information is needed for ChangePassword and the Method may be called by a Session that has the Anonymous Role only.