There's a PLIST entry possibly relevant to it in
`~/Library/Preferences/com.apple.networkserviceproxy.plist`
I couldn't figure out how to get any changes to reflect but maybe it's a good pointer towards a solution?
EDIT: Reading into this, looks like they're very intentional about not allowing arbitrary enable/disable calls to it, likely to prevent a hostile entity from switching it off on unsuspecting users. The systems setting calls an XPC into a daemon that makes a web request, then validates the response from the API to update the PLIST structure.
I couldn't figure out how to get any changes to reflect but maybe it's a good pointer towards a solution?
EDIT: Reading into this, looks like they're very intentional about not allowing arbitrary enable/disable calls to it, likely to prevent a hostile entity from switching it off on unsuspecting users. The systems setting calls an XPC into a daemon that makes a web request, then validates the response from the API to update the PLIST structure.