Should be as simple as NOT list = '[]', but of course it's not.

There is a separate JSON function for it called JSON_LENGTH with which we can check it:

SELECT id
FROM users
WHERE NOT JSON_LENGTH(roles) = 0