OK, now that I've looked at it more closely, I've found that generated PPs all have "-systemextension" appended to their values. Whereas apps entitlement doesn't have that. I've went through PP setting on developer.apple.com but can't find a way to get rid of those appendices. What are they for?

Found this page, that suggests it should be available: https://help.apple.com/developer-account/#/devadf555df9

Thanks for suggestion. I've switched to automatic signing and when I'm trying to export an app with Developer ID signing, I get an error: Cannot create a Developer ID provisioning profile for "my app bundle" The Network Extensions capability is not available for Developer ID provisioning profiles. Disable this feature and try again. Does it mean it's impossible to distribute apps with Network Extensions outside Mac AppStore?