That's about 5% of what the CoInitializeSecurity in TCC does. (For example, the security descriptor has all the ACE's & ACL's configured.)
Maybe so, but it leaves an inability to launch/start Office-associated file types (a chore with other apps don't seem to have a problem). My kludge fixed that and, so far, hasn't broken anything. If you'd say where TCC uses COM I'd test more. I have only tested WMI stuff and the registration dialog.
I don't know how TCC is initializing COM and COM security, but it seems to have a problem when it comes to files associated with Office 2019/store. And initializing differently doesn't have such a problem. It's as simple as that.