To answer myself:

It turns out that later releases of PlatformIO have broken compatibility with makeconfig and the right fuses are not set.
I am now porting everything to ESP IDF to get rid of having to use platformIO.

Sorry for the kick of this topic but did you ever get this sorted? I have exactly the same issue. I have a custom board that I have in production with security on in release mode. However, I wanted to test some new things and tried to flash a board in development mode with a fresh install of ESP-IDF...