I just read the following, regarding a issue we have on SharePoint Server 2019, with an app we can't trust if it requires tenant admin permissions (even if the account we use has full admin rights)
registering app principle for a tenant full control app won't be possible as you need to have an app which go through approval process by tenant admin. the issue is even if you are a tenant admin the trust button will be always disabled. The work around is to create a sharepoint add-in .app file and upload it to your app catalog then the approval process will kick in and you can then use your clienID and secret in your apponly scenario
My question is : is it a bug or is it by design ?