If an user resource has the forcelocal parameter set, the /etc/passwd file is being read once per user resource per managed parameter (until it finds a match). We could read /etc/passwd once per user resource without too much difficulty. Reading it once per transaction is also a possibility but users could be created mid-transaction...
When managing a user/group resource with forcelocal set, Puppet would read /etc/passwd or /etc/group for each parameter of the resource. Now the files are being read once per managed resource.