@glyph @hynek I suspect that it is a security design choice.

SystemExtensions are typically security-related tools. Installing them requires interactive authentication and authorization. Providing a scriptable tool that could be used by malware to remove them quietly would add attack surface.

There also may be practical problems with removing pieces of the networking stack w/o entirely re-initializing the network state of everything, which users might well not understand or desire.