Race Condition in `default_branch_protection` handling when using the API to set it on instance-level

We've got some users experiencing issues with the Terraform Provider for GitLab when creating a new project. Besides these issues (for which I may create some more issues here, since I think that there are more bugs / strange undocumented behaviors) I've found a weird behavior during my attempts to reproduce it.

When changing the default_branch_protection on instance-level, it seems not to be applied instantly. Consider the following script (an API and GITLAB_TOKEN variable with admin access is required):

#!/bin/sh

set -x

curl -X PUT "$API/application/settings" --header "PRIVATE-TOKEN: $GITLAB_TOKEN" --header "Content-Type: application/json" --data '
{
 "default_branch_protection": 0
}
'

# wait for it to propagate - whatever that means, but that's the point of this issue after all :D
sleep 10

curl -X PUT "$API/application/settings" --header "PRIVATE-TOKEN: $GITLAB_TOKEN" --header "Content-Type: application/json" --data '
{
 "default_branch_protection": 2
}
'

project=$(curl -X POST "$API/projects" --header "PRIVATE-TOKEN: $GITLAB_TOKEN" --header "Content-Type: application/json" --data '
{
 "name": "fun-with-default-branch-protections",
 "default_branch": "main",
 "initialize_with_readme": true
}
')
project_id=$(echo "$project" | jq -r '.id')
curl -X GET "$API/projects/$project_id" --header "PRIVATE-TOKEN: $GITLAB_TOKEN" | jq

... running it a few times will eventually end up in a situation where the default branch in the fun-with-default-branch-protection repository is not protected (also verified in the UI).

Now my question: what exactly happens when the default_branch_protection setting with the application/settings API endpoint is being set? Does this trigger some kind of background task to propagate it? Or is there some caching going on?

What's a reliable way to know if that has happened? Until when after setting the value in the API can I expect new projects to be created according to it?

/cc @nagyv-gitlab @nmezzopera may I once again ask for your triage wizardry ? I don't have time to dig into it myself right now ... 😿