Do not allow users to disable SEP client - partially not functioning

Hi all

It seems that users can now partially disable SEP client inspite both "Allow users to enable and disable..." options in Client User Interface Settings are ticked off. Specifically, "Disable Symantec Endpoint Protection" option (after right click on SEP icon in system tray) is no longer greyed out and when user selects it it disables Generic Exploit Mitigation (screen below).

I was wondering if this is by design? This is new feature, possibly with issues, but I still don't think it is a good idea to leave it to (my) users to decide if they are going to use it or not.

Is there a way to disable this behaviour? Am i missing something?

Regards