so I went to audit if a particular EndpointSecurityFramework/SysExt agent/process (rhymes with CloudPsych) was running with full disk access and found almost nothing actually enabled according to the access table in /Library/Application\ Support/com.apple.TCC/TCC.db (either their auto-update or recent macOS updates have done a bangup job of screwing the pooch)