Right now, if you try to give a command like

/feperm user $USER allow fe.perm.zone deny fe.perm.zone.*

you will get 3 allow permissions:

fe.perm.zone=true
deny=true
fe.perm.zone.*=true

The desired result, obviously, is

fe.perm.zone=true
fe.perm.zone.*=false

Since there's no permissions named "allow" or "deny", this change should be "safe".

Yes, I can do it in two commands. But I've found it most cumbersome in this specific case - in many of these cases, when I need to +x -x.* due to the way FE evaluates permissions.
When I want to give someone, say, /zone list permission, is is not enough to +fe.perm.zone.list, because FE will first test for fe.perm.zone (twice!), and only THEN it will try to match fe.perm.zone.list.

And on the "+-" - I understand where you are coming from, but right now, FE is nicely explicit in its syntax.
I'd rather keep it intact, if possible.

I really think we don't need this - you can chain all allow-permissions and all deny-permissions in a second command. That should be sufficient.

Also I'd rather do it like this then:
/feperm user $USER +fe.perm.zone -fe.perm.zone.* then.

As we moved to 1.12.2, is this still an issue? Closing this issue in 7 days if no response @AnrDaemon

It's not an issue, it's a feature request. :P