Thanks for the swift reply. I posted my initial question from another dev forums account but will switch to using this one instead. I'll be submitting an enhancement request and will post back the bug number.

Try sfltool resetbtm (note the extra L).

This is good because it validates the fix I was going to push (almost exactly what you suggested) - even though I can't reproduce the original issue. Thanks for the quick response!

Note: at least for me, this is not limited to having multiple requests from the same App. This also happens when there's more than one App requesting to install System Extensions.

I'm running both debug builds and release builds (both installed in /Applications). And other people seeing the different behaviour are running both the debug and review builds I'm using too.

What are the other options for macOS? I'd like to create and configure NEAppProxyProviderManager programmatically if possible, without MDM, but I'm having a hard time finding an easy-to-follow explanation of how this'd work.