'Change theme' is an og_permission, not a os_sync permission, hence it must be added hard coded as it was (or maybe we should add another attribute via hook_og_permissions_alter() to the permissions we want in cp).