VPN connection requests admin authentication

[dsd]

Upon trying to connect to a VPN (which i created within my EOS6 install before upgrade) via GNOME menu, I get this prompt:

I would have expected it to go forward and connect directly as before.
If you cancel the above prompt it does connect to the VPN successfully and this message is logged:

polkitd[878]: Operator of unix-session:2 FAILED to authenticate to gain authorization for action org.freedesktop.NetworkManager.settings.modify.system for unix-process:2148:2125 [/usr/bin/gnome-shell] (owned by unix-user:dsd)

[dsd]

Setting polkit_noauth_group=sudo in the NetworkManager build would install the org.freedesktop.NetworkManager.rules polkit rules file and match eos6 behaviour.
But it seems discouraged: https://github.com/NetworkManager/NetworkManager/blob/748be9a3e7ac8706fbed21dd921d7e8058672194/data/org.freedesktop.NetworkManager.rules.in#L5

And i'm not sure why it's needed. System wifi connections can be activated without this. The .nmconnection file in /etc/NetworkManager/system-connections does not get modified when connecting to the VPN. Why does it need this special modify permission to connect to a VPN but not to connect to a system wifi network?

[dsd]

I think the relevant codepath is

_con_get_request_start(Request *req)
{
    NMAgentManager      *self;
    NMSettingConnection *s_con;
    const char          *agent_dbus_owner, *perm;

    self = req->self;

    req->con.current_has_modify = FALSE;

    agent_dbus_owner = nm_secret_agent_get_dbus_owner(req->current);

    /* If the request flags allow user interaction, and there are existing
     * system secrets (or blank secrets that are supposed to be system-owned),
     * check whether the agent has the 'modify' permission before sending those
     * secrets to the agent.  We shouldn't leak system-owned secrets to
     * unprivileged users.
     */
    if ((req->con.get.flags != NM_SECRET_AGENT_GET_SECRETS_FLAG_NONE)
        && (req->con.get.existing_secrets
            || _nm_connection_aggregate(req->con.connection,
                                        NM_CONNECTION_AGGREGATE_ANY_SYSTEM_SECRET_FLAGS,
                                        NULL))) {
        _LOGD(NULL,
              "(" LOG_REQ_FMT ") request has system secrets; checking agent %s for MODIFY",
              LOG_REQ_ARG(req),
              agent_dbus_owner);

Why does it need this special modify permission to connect to a VPN but not to connect to a system wifi network?

I was settling on a theory: System wifi networks have the passphrase stored in the .nmconnection file. NetworkManager has direct access to this, it can just read the secret. But for VPN, the secret is stored in gnome-keyring. So that's a different level of having to send the secret around, and it asks for authorisation.

But the theory doesn't hold: if I click cancel and deny this request for permissions, the VPN connection completes anyway. So it is not relying on this permission for being able to pass the secret to the appropriate place, or to establish the connection.