I have the same situation exactly. Problem found on Mi13 Miui14, but NOT my Mi9 Miui12.
checked with Google MDM team, it wasn't the device policy crossing restriction to Dual-apps, it was Miui Dual-app placing the cloned app into Work-Profile, hence the cloned app get restricted indirectly.