From my research it is part of the kernel cmdline now, but not sure where that is set. I am willing to re-compile....on PH-1 (mata) this build starts with SELinux permissive, which after Magisk becomes disabled(!). For comparison, other PHH based ROMs start with enforcing...
I would prefer a recommended non-Magisk method to setenforce survive reboots. It appears most solutions just execute setenforce during the boot process, but use frameworks like Magisk to manage it. What is the recommeded way to add a "boot script" in Android 11?