On el8 there appears to be a case where you can install an RPM and will not see the changes in the trust db without manually reloading trust.

Maybe the dnf plugin is opt-in, or doesn't work?

There were plans in the past for a sync check between the rpm db and fapolicyd trust db. That could be done, but at least there should be a UI control for convenience.