dc32f0cfe84def651e0e That is completely expected. eSIM activation is still the same as it was before (requires Sandboxed Google Play in the owner profile as well as the privileged eSIM activation toggle to be enabled).
The change here is that the eSIM firmware updater app is no longer gated by that toggle and enabled by default with these new improvements, which is important, as it... well, provides firmware updates to those components.
It is possible that in the future there will be an open source Google-independent way to activate eSIMs as well, at which point the privileged activation toggle would be done away with, but alas, that's not today. :)