I mentioned yesterday that I just bought a new M4 MacBook Pro, which of course comes with macOS Sequoia. Before I enabled iCloud on the new Mac, I installed a configuration profile created with Apple Configurator app. The purpose of the configuration profile was to prevent iCloud from silently enabling features that I don't want. I discussed this technique last year in a blog post about how to stop iCloud Keychain with a profile. My configuration profile disables not only iCloud Keychain but also iCloud Photos, Siri, Diagnostic Submission, and Apple Personalized Advertising. Below is a screenshot of the profile in which you can see that Allow iCloud Photos is unchecked. (Most of the settings are just default values that I didn't change.)
I installed the profile, and then I enabled iCloud on the new Mac. (I avoided enabling iCloud in the macOS Setup Assistant.) The profile mostly worked—iCloud Keychain was disabled, as planned—but it didn't work right with iCloud Photos. You can see in the screenshot below from System Settings that iCloud Photos was enabled rather than disabled.
Yet it says that the setting has been configured by a profile, and indeed the toggle is disabled, as expected with a managed setting. Thus, in order to disable iCloud Photos, I had to create another configuration profile with Allow iCloud Photos checked, install that profile to enable the toggle, manually disable iCloud Photos, and then install my original profile again.
Fortunately, I didn't actually have any photos in the Photos library on the new MacBook Pro, because I was still setting it up and hadn't migrated any data yet, so nothing got uploaded to iCloud without my consent. (I hadn't used Migration Assistant either.) Still, this seems like a pretty bad bug, at least in principle.
I've filed FB16344371 "mobileconfig failed to disable iCloud Photos" in Apple's Feedback Assistant.