Update- I decided to play guinea pig, even though I was pretty sure of the outcome. I'm not tuning until mid-late next year, and warranty will run out by the time the car comes out of winter storage so I decided to try and get the newest FW I could before putting it away.
I brought the car to the local BMW dealership to ask them to do an i-level update as well as look a seatbelt issue for warranty. I have a 2016 w/20k mi, so it's still under factory coverage. They gave me the same answer I've seen in other threads: neither they or the manufacturer recommend doing an i-level update for no reason because of risk. The cost is around $200 (2hr) depending on labor rate, and BMW will only recommend/cover it under warranty if there is a problem that requires a module to be reflashed. Luckily, I happened to have experienced the HK-amp-cutting-bass problem (TSB B651016) about 4 times since buying the car, and the SA came back after a while and it turns out they would have to do an i-step update to reflash the amp
4 hours later, picked up the car and drove it home. Exported profile, checked new i-step: F020-19-07-539 (July 2019). Unfortunately there is no detail on the work order so I don't know specifically what modules were flashed, and I can't comment on if it drives any different because learned adaptations for any modules that were flashed as well as fuel trims etc would have been reset. After a week or so I should have a decent idea if it drives any different. My iDrive profiles were wiped and bimmercode settings reverted so I can surmise that the FEM, headunit, cluster, and SRS at least were flashed.
So I wont be doing any flash tuning this year, which is fine, and it will give PTF and the rest of the tuning community time to re-crack this new round of encryption and or shed more light on it. I'll edit back in a week or so with whether or not I noticed difference anywhere, from features/functionality to drivability for those interested -edit after more than a week: no difference at all, for sure. Car drives exactly the same after full learning.
Summary - 2016 M235i went from
F020-16-03-504 to new
F020-19-07-539, previously confirmed anything from F020-19-03-5xx and up having the new round of BMW tuner protection