I have filed this bug under two separate incidents: SFAuthorizationPluginView disables ScreenSaver System Wide without use-login-window-ui-rule FB13204883 SFAuthorizationPluginView at Lockscreen does not show Curtain or Screensaver (Privacy issue) FB13225406 Additional info is added the privacy issue.

But ideally we need the host app to be able to talk to the app extension via the TKTokenConfig. Apps outside of that direct relationship are not allowed unless you spoof the app build ID which less than ideal. I have yet to see the suggested _securityagent trick work properly without ending in a trap / error and have never seen it work at the loginWindow without a launchagent running the host app which runs as root there btw not as the _securityagent.