exploit and mitigation security settings

ive found sound rather odd behavior when running "Set-Processmitigation" commands. for example, when running:


going to Windows Security > App & browser control > Exploit protection > Exploit protection settings will show not only CFG being enabled, but it also enables DEP and SEHOP.

another example, when running:


it does turn off CFG, but enables the formentioned DEP and SEHOP. this is when all exploit protection options were set to "Off by default" prior. does anyone know whats going on here and how to fix this so disabling the settings using this method doesnt effect other exploit options?

I don't dabble in Process Mitigation, but -System (System-level) policy != App-level policy.