By similar experience if you have mutliple profiles both with the same sys ext approval the approval is tied to a random MDM profile and the MDM approval was only checked at profile install or sysext install.