Silent APK installation by the device owner doesn't work on MIUI 11

I have a "device owner" Android app which silently installs APK using PackageInstaller (see the code, for example, here).

This code works perfectly on all Android 7+ devices except Xiaomi Redmi 7A (running MIUI 11). The installation fails, here's the related logcat output:

01-16 00:43:21.494  1488  2892 I InstallationStatistic: beginInstallSession: 417086238
01-16 00:43:21.600  1488  1658 D com.android.server.pm.PackageManagerServiceInjector: Package verify start
01-16 00:43:21.601  1488  1538 D CompatibilityInfo: mCompatibilityFlags - 0
01-16 00:43:21.601  1488  1538 D CompatibilityInfo: applicationDensity - 320
01-16 00:43:21.601  1488  1538 D CompatibilityInfo: applicationScale - 1.0
01-16 00:43:21.611 24382 24395 D  GuardProvider: start parse apk : /data/app/vmdl417086238.tmp
01-16 00:43:21.618 24382 24395 E i.guardprovide: Invalid ID 0x00000000.
01-16 00:43:21.638  4434 24418 D PackageVerifyedRecevier: verify package /data/app/vmdl417086238.tmp info:  PackageInfo{45d0d6b com.hmdm.sendphoto}
01-16 00:43:21.638  4434 24418 D PackageVerifyedRecevier: verify package /data/app/vmdl417086238.tmp finish true
01-16 00:43:21.639  1488  1658 I com.android.server.pm.PackageManagerServiceInjector: MIUILOG- Install Reject uid: 10161 pkg : com.hmdm.launcher
01-16 00:43:21.639  1488  1658 E PackageInstaller: Commit of session 417086238 failed: Permission Denied

Package ID of the installer (device owner) is com.hmdm.launcher. Package ID of the app being installed is com.hmdm.sendphoto.

I tried to add the "Install unknown apps" permission but this didn't help.

Looks like the app must request MIUI OS for some special (undocumented) permissions?

The device owner rights were granted to the application by QR code based enrollment.

Also with MIUI 10.3 some apps are refused to install/update. For instance, I cannot install a Threema update the usual way (and just get a silly error 'not installed'). logcat shows that com.miui.global.packageinstaller.action.verifypackage called by com.android.server.pm.PackageManagerServiceInjector fails:

02-16 11:29:05.809  1271  1853 D com.android.server.pm.PackageManagerServiceInjector: Package verify start
02-16 11:29:05.810  1271  1317 D CompatibilityInfo: mCompatibilityFlags - 0
02-16 11:29:05.810  1271  1317 D CompatibilityInfo: applicationDensity - 440
02-16 11:29:05.810  1271  1317 D CompatibilityInfo: applicationScale - 1.0
02-16 11:29:05.812  1271  6228 W ActivityManager: Sending non-protected broadcast com.miui.global.packageinstaller.action.verifypackage from system 3440:com.miui.securitycenter.remote/1000 pkg com.miui.securitycenter. Callers=
02-16 11:29:05.816  3440 25765 E ActivityThread: Failed to find provider info for guard
02-16 11:29:05.817  3440 25765 E PackageVerifyedRecevier: parseApk
02-16 11:29:05.817  3440 25765 E PackageVerifyedRecevier: java.lang.IllegalArgumentException: Unknown URI content://guard
02-16 11:29:05.817  3440 25765 E PackageVerifyedRecevier:   at android.content.ContentResolver.call(Unknown Source:63)
02-16 11:29:05.817  3440 25765 E PackageVerifyedRecevier:   at com.miui.permcenter.install.q.doInBackground(Unknown Source:17)
02-16 11:29:05.817  3440 25765 E PackageVerifyedRecevier:   at com.miui.permcenter.install.q.doInBackground(Unknown Source:2)
02-16 11:29:05.817  3440 25765 E PackageVerifyedRecevier:   at android.os.AsyncTask$2.call(Unknown Source:20)
02-16 11:29:05.817  3440 25765 E PackageVerifyedRecevier:   at java.util.concurrent.FutureTask.run(FutureTask.java:266)
02-16 11:29:05.817  3440 25765 E PackageVerifyedRecevier:   at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
02-16 11:29:05.817  3440 25765 E PackageVerifyedRecevier:   at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
02-16 11:29:05.817  3440 25765 E PackageVerifyedRecevier:   at java.lang.Thread.run(Thread.java:764)
02-16 11:29:05.817  3440 25765 D PackageVerifyedRecevier: verify package /data/app/vmdl216836998.tmp info:  null
02-16 11:29:05.818  3440 25765 D PackageVerifyedRecevier: verify package /data/app/vmdl216836998.tmp finish false
02-16 11:29:05.818  1271  1853 I com.android.server.pm.PackageManagerServiceInjector: MIUILOG- INSTALL_FAILED_VERIFICATION_FAILURE  uid: 10026 pkg : com.google.android.packageinstaller

What worked for me was to move the apk file to /data/local/tmp/ and then call as root

pm install -r file.apk