I am the user in question, so I guess I might as well chime in directly.
let your customer set up a virtual machine and grant the Local Network privilege to their app there
In this specific case, it's not a GUI application, it's a Python library, which has some multicast logic in it. Are you suggesting that the only option now is to block every test run on a user manually VNCing into a cloud CI backend to manually click on some GUI preferences? As you might imagine, this is not feasible either for an open source library that needs to accept volunteer contributions or a hosted CI service with ephemeral test runners.
(The practical upshot of this is that we will need to treat macOS as a platform which can no longer support multicast sockets, which would be a bit of a bummer.)