Regarding the

system_extensions

table and the new mdm_managed column implementation… it doesn't rely on the presence of the sysext before returning its bool-as-int, 1 if "pre-allowed", 0 if not, correct?

it's reading from the config files rather than enumerating the loaded system extensions, so I think the answer is "you are correct" but @Akshay Kumar can confirm