This behavior is expected. The reason is because the parent process is explorer.exe that is not excluded in the rule: Common Standard Protection: Prevent modification of McAfee files and settings.

IMPORTANT: Although the rule does not trigger if explorer.exe is added to the McAfee files and settings rule: Common Standard Protection, Prevent modification of McAfee files and settings, excluding high-risk processes, such as explorer.exe, from this rule is not recommended. The reason is because VSE must monitor parent and child processes from malware that can hijack the system and run with trusted process name (being parent) for malicious purposes.