Glad you figured it out. User actions take precedence over general actions when defined.
You can define the direct keypad arming/disarming also in the user specific actions so that some users can arm using the keypad while other can only lock/unlock.
This is by design, in this instance the keypad is being used as standalone lock device and not a general security keypad. The purpose of the light is to show the status of the lock device (locked or unlocked). So when you lock it via the keypad it turns red and when unlocked it’s green/white (depending on the keypad model).