Isn't that one of the main functions of a Mandatory ACL tool like AppArmor/SELinux - not allowing a program to operate outside of the normal confines?

I'd be happy to know it was working as indented, and a short google would lead you to the answer. In fact, Digital Ocean's documentation is the first result and it's right there in the steps.

It is the purpose of AppArmor. But in normal land, we just expect documented MySQL options to work.

It really was insane for MySQL package maintainers to make AppArmor the default experience. It ought to have been a separate package, where people that wanted AppArmor could have AppArmor.

What prevents you from updating the profile?

The error messages you get are NOT helpful in allowing you to figure out what just went wrong, so if you don't know about it there's a huge cognitive gap because things that SHOULD work just don't for no valid reason.

Denials by AppArmor (or any other ACL addition) really should have a more verbose diagnostic message AND a dedicated ERRNO that is different from the standard ones.

This can also cause a bunch of fun errors (on installation no less) when you have custom PAM plugins. At least last time I had to deal with that (might have been as long ago as 12.04).