The old line used to match when it was WIRED_MAC_AUTH over EAP.
Thus it tried to call &pf::authentication::match with a MAC for username, resulting in no role ever being assigned because there is not user named bc:c6:db:1c:2b:a4 (for example).