Oh, I wonder if this could have to do with full disk access?

didn't notice anything with

log stream --debug --predicate 'subsystem == "com.apple.TCC"'

, and adding

/var/lib/orbit/bin/orbit/orbit

and

/var/lib/orbit/bin/osqueryd/macos-app/stable/osquery.app/Contents/MacOS/osqueryd

to full disk access appear to have no affect