GRUB_ENABLE_BLSCFG is forcefully set to "false" in /etc/default/grub after the first kernel update when VM is running under Xen hypervisor. This happens due to a faulty logic in /usr/lib/kernel/install.d/99-grub-mkconfig.install:

# PV and PVH Xen DomU guests boot with pygrub that doesn't have BLS support,
# also Xen Dom0 use the menuentries from 20_linux_xen and not the ones from
# 10_linux. So BLS support needs to be disabled for both Xen Dom0 and DomU.
if [[ -e /sys/hypervisor/type ]] && grep -q "^xen$" /sys/hypervisor/type; then
    RUN_MKCONFIG=true
    DISABLE_BLS=true
fi

The check could probably be fine tuned to only affect Xen PV/PVH as the comment states (and not Xen HVM which is far more widespread) but RHEL9 does not support XEN PV and PVH at all as we have:
# CONFIG_XEN_PV is not set
in the kernel. RHEL9 only support Xen HVM to be able to run in AWS, there's no pygrub usage there.

This piece of logic can just go away in RHEL9 I believe.