The ManagedSettings store will only report back settings that you've set in it. So for example, if you set store.shield.applicationCategories = .all(except: exceptions), when you query store.shield.applicationCategories again, it'll return .all(except: exceptions). Similarly, if you don't set store.shield.application, when you query its value, it'll return nil as you haven't store anything for that setting.
Both the shield.applicationCategories and shield.applications are separate settings that work in tandem to allow authorized applications to shield apps. shield.applicationCategories lets the authorized application shield other applications based on their category with specific exceptions, whereas shield.applications allows it to shield specific applications instead of by category.
shield.applications is not meant to be used to query what apps are shielded on the device, it is a setting that allows your app to shield specific apps via ApplicationTokens the user has selected via a FamilyActivityPicker. shield.applicationCategories will also not report what apps are shielded via this setting, it'll only report what ActivityCategoryPolicy you've used to shield applications.
It is currently not possible to get the full list of apps that the ActivityCategoryPolicy affects. If you'd like to see this added to the API, please file a report via Feedback Assistant