After a little tinkering I managed to update properly. For those who have magisk root in work profile as well and fail safety net there, follow the steps with xprivacylua and in lsposed modules, find select the work profile tab (the work profile is named avalom for me, cuz that's the default from Island app), find the xprivacylua module there too and enable the services the steps tell to do so apart from system framework, because appartley this doesn't exist in work profile.
Btw, xprivacylua seems to be the best (mandatory) addition in this weekly. It's ~like xiaomi's privacy settings, but probably even more powerful!
Edit: can we somehow use that module to bypass detection of some apps that somehow detect unlocked bootloader or root access?