For anyone interested, I learn from NetSuite that the “OAUTH 2.0 CONSENT POLICY” field is never migrated between accounts when using SDF for security purposes. This forces explicit consent for each account.

Correct, NS keeps a global definition of the integration record. Once invoked, NS looks it up and applies it to the account. And explicit consent is required, like you stated.