Istiod does not deploy on latest release when using TID (enterprise)

See MR where this is shown happening in CI: !3749 (closed)

Locally it seemed like the issue was istiod getting blocked by kyverno policies for non-root group and this is captured in the events as well - https://repo1.dso.mil/big-bang/bigbang/-/jobs/30819829/artifacts/file/events.txt

I haven't identified the exact issue, but it looks like TID is one minor version ahead of the upstream/default istio (1.20 v 1.19). I couldn't find any release notes indicating a change in this minor version but it's a bit hard to identify changes in the operator since its less supported now.

Maybe this is a separate issue but I don't believe that TID/enterprise is tested in any of the pipelines, which seems problematic?