Xcode saying Network Extension capability is not enabled when it is

For anyone wanting to use Network Extensions in their macOS app:

Developer ID provisioning profiles actually don't support the Network Extensions entitlement. Development and App Store provisioning profiles on the other hand do support it. It's not well described in Xcode or the developer site (which show it as enabled). It's not until attempting to distribute an archive with the Developer ID provisioning profile that you will see that it is not included, or by running security cms -D -I Developer_ID.provisionprofile.

See question #8 in this Apple developer forums post: https://forums.developer.apple.com/thread/67613