I have always been under the impression that to remove DEP enrolled devices from the network, you need to "Unassign settings" under Systems Manager > Manage > DEP. Which is direct opposite of enrolling them by "assigning settings" in MDM which consum...

Did you choose a Device profile (Default) or User Profile (Apple)? Former has all available settings, latter what you have on your screenshot.

Are there any security implications? We have quite a few devices enrolled in 2019 that have 3 out of 5 signing certificates expired, which marks Management Profile as "Not Verified". I'd rather not re-enroll a thousand odd devices.

Just spin up a separate MDM network per each domain. We have four in our tenant with different authentication methods.