Technically, powershell and "cbsreg" code block indeed are using methods to gain "TrustedInstaller" token to modify registry but it's inevitable
Have tried it again on a clean 25H2 system, since earlier Defender got a new engine update (4.18.26050.15) and newer defs but i got twice the same (bad) result. Installed another AV and went fine.
I believe i processed them all now, special thanks to @steven4554 for providing links and mental help
[DISCUSSION] Windows 11 Insider Preview Build 29610.1000 (PC) [Canary - rs_prerelease] or [DISCUSSION] Windows 11 26H1 Insider Preview Build 28020 (PC) [Canary - br_release] ?
All above booted fine on VMware® Workstation Pro 26H1 version 26.0.0.25388281 and on VBox Version 7.2.10 r174163 (Qt6.8.0 on windows)!!!