Thank you eskimo. The --deep was the culprit here. Removing that made it work. I was under the wrong notion that it needs to be given always.

Yes, it is manually set. One more small update is that, after I did a build , inside the build directory (SourceCode -> Build for eg) I could find the main app, findersync and endpoint security extension all present together. The findersync in that directory (SourceCode -> Build -> Findersync) has the correct entitlements. But when I went inside the SourceCode -> Build -> main.app -> Contents -> Plugins -> FinderSync , this one does not have the correct entitlement. This has the same entitlement as the main.app.