Posgres Row Security Policy - Why Array faster than Bitstring?
It doesn't matter very much how big the data structure is, as long as the row is small enough not to get TOASTed (stored out of line, in which case access becomes more expensive).

The performance difference you measure might as well be the cost of the different operators (&amp; vs. array element access).

I don't believe that you can do that more efficiently than you did. Row level security comes with a performance hit that is ideally proportional to the number of rows checked, and the performance impact will be most visible with a cheap access path like a sequential scan.