Seems like this copy-pastes some logic from childThreadInfos. Should it be factored out instead, and updated to support RawThreadInfo | ThreadInfo?

Nit: shorthand

for...in syntax seems cleaner here

What happens if role.specialRole === specialRoles.ADMIN_ROLE but there is no rolePermissionBlobs.Admins? If that is an unexpected case, should we do something about it? (invariant or at least some sort of log?)

Can you explain each of these conditions in code comment(s)? It's non-obvious to the reader why permissionsUpdater is only used in this case.

Interesting, I didn't realize you could declare a type inside a function like this

Since thick threads won't have thin threads as children, it seems like a better approach would be to simply "early exit" here:

if (!threadInfo.thick) {
  return;
}

This would also allow you to simplify the let memberToThreadPermissionsForChildren assignment (get rid of updatedMemberToThreadPermissionsForChildren, and just have a single const variable)

Can you add a code comment here explaining why we only call updateMembers for thick threads?

This condition is confusing.

1. Why do we need to consider both thread.thick and !thread.parentThreadID? Is it specifically for the case of thick sidebars?
2. Why don't we want to consider thin subthreads? Is it because we're assuming something about the permissions change? Aren't there some possible permissions changes that would affect the role permissions of thin subthreads?

The reader might be confused why we recursively handle the permissions below, but not these ones. It would be helpful to explain somewhere that the member and current user permissions "cascade" from parents, but the role permissons do not

Can you add a comment to ENG-9404 mentioning that this logic can be removed once member permissions are removed from ThickRawThreadInfo, in the same way they've been removed from ThinRawThreadInfo?

Can you add a comment explaining how the DELETE_ALL_MESSAGES permission is populated for admins?

Can you add a comment explaining how the DELETE_ALL_MESSAGES permission is populated for admins?