Content moderation - workflows / weird behavior
What I did was create a new state called Needs Review to mimic draft state at /admin/config/workflow/workflows.

The one thing to note is to check default revision. Then set the permissions and you should be able to go from publish to unpublish.

After the change here is what your configuration should look like.