answer deleted by me because i was wrong
I guess ATTrackingManagerAuthorizationStatusRestricted means the device is under MDM (mobile device management) and will thus not ask the user for consent (not show the ATT prompt) but will return what is configured for this device in the connected MDM if you call ATTrackingManager requestTrackingAuthorizationWithCompletionHandler.
Apple's source code in ATTrackingManager.h says:
/*!
* @property trackingAuthorizationStatus
*
* @abstract
* Returns information about your application’s tracking authorization status.
* Users are able to grant or deny developers tracking privileges on a per-app basis.
* Application developers must call `requestTrackingAuthorizationWithCompletionHandler:` for the ability to track users.
*
* @result
* The current authorization status. If the user has not yet been prompted to approve access, the return value will either be
* ATTrackingManagerAuthorizationStatusNotDetermined, or ATTrackingManagerAuthorizationStatusRestricted if this value is managed.
* Once the user has been prompted, the return value will be either ATTrackingManagerAuthorizationStatusDenied or ATTrackingManagerAuthorizationStatusAuthorized.
*/
@property (class, nonatomic, readonly, assign) ATTrackingManagerAuthorizationStatus trackingAuthorizationStatus;