What do "changed": true from the user module and CHANGED | rc=0 from the command module tell you, and why do they differ?

"changed": true means the user module found the account missing and created it; a second run would report false. The command module just runs a program, can't know whether anything changed, and therefore reports CHANGED every time, with rc=0 meaning the program succeeded.

$ ansible -m user -a 'name=newbie uid=4000 state=present' servera.lab.example.com
servera.lab.example.com | SUCCESS => {
    "changed": true,
    "home": "/home/newbie",
    "uid": 4000, ...
}

$ ansible mymanagedhosts -m command -a /usr/bin/hostname
host1.lab.example.com | CHANGED | rc=0 >>
host1.lab.example.com

The user module is state-aware: it compares the desired state (state=present, UID 4000) with the host and only acts on a difference. That is what makes it idempotent and what makes changed meaningful.

The command module runs an arbitrary program on the host (no shell, so no pipes or redirections). Ansible has no idea what that program does, so it assumes the worst and reports CHANGED, even for a read-only command like hostname. rc is the program's return code; 0 means success. This is why you prefer a dedicated module whenever one exists, and use command (or shell) only as a last resort.

Go deeper:

• command module (official docs) — no shell processing, creates/removes to make it idempotent.
• user module (official docs) — the return values changed, home and uid.