Nah, it was something between a lucky hunch and laziness. The backup plan was to test it an hour later when leaving the office for lunch but the restart worked. I actually realized it had to do with significant location changes early on since it was the new thing we added.

By the way, in general this isn't a reboot specific bug, the most secure setting is actually not the "allow after unlock" one but the one that gives no access to keychain if your phone is locked at any time. I noticed that keychain starts refusing access 15 seconds after you lock the phone but most apps keep their credentials in memory after they're read and the problem appears at reboots only.