Description:
By default sane-backends generates 49-sane.rules that change MODE to 0660 and GROUP to scanner. For MFDs 50-udev-defaults (from systemd) changes GROUP to lp. Thanks to 70-uaccess libsane_matched=yes devices are available to current 'driving' user, but scanner group can't use it.
To avoid that I propose to switch to ACL-based rules.
It could be done as patching generator Makefile.in (where is formatting help, btw?):

diff --git a/sane/trunk/PKGBUILD b/sane/trunk/PKGBUILD
index d386351..50ac38f 100644
--- a/sane/trunk/PKGBUILD
+++ b/sane/trunk/PKGBUILD
@@ -6,7 +6,7 @@

pkgname=sane
pkgver=1.0.27
-pkgrel=1
+pkgrel=2
pkgdesc="Scanner Access Now Easy"
url="http://www.sane-project.org/"
arch=('x86_64')
@@ -24,6 +24,7 @@ prepare() {
cd "${srcdir}/${pkgname}-backends-${pkgver}"
# fix http://vasks.debian.org/tracker/?func=detail&atid=410366&aid=313760&group_id=30186
patch -Np1 -i ${srcdir}/network.patch
+ sed -e 's/sane-desc -m udev /sane-desc -m udev+acl /' -i tools/Makefile.in
}

build() {

Or we can change build phase to invoke sane-desc again ourselves.

Additional info:
* sane 1.0.27-1
* systemd 236.81-1

Found this while investigating problems with https://aur.archlinux.org/packages/brscan4/