So, NM only invokes wpa_supplicant via D-Bus, as I supposed. Hence we'd have to backport dbus module (and run D-Bus in the initrd), which we don't want to do. What we could do, though, is to put wpa_supplicant into a separate module that'd only be included in the initrd if explicitly requested via configuration. Then only those who chose to use wpa_supplicant would get dbus.
As David mentioned, we don't have dbus in rhel8 initrd and since we changed the implementation of dbus (dbus-daemon vs. dbus-broker) so adding it to rhel8 is not a trivial task. Also, we don't run NM as a daemon in rhel8 which is yet another hurdle. Maybe we could run wpa-supplicant manually before NM. But the main question, where to store the password. Initrd is never encrypted.