Yuval, thanks for your response. Totally agree that neither model is permissionless in the bearer sense, and that KYC/AML constraints apply regardless of issuer or DTCC.
Where I still see a meaningful difference is not whether DeFi-style interaction is possible, but how much