Drupal 8: Bypass permissions list for form not updated

The permissions list isn't updated because it is unable to detect the type of form being protected after the AJAX callback. Given that there are a few issues here, it seems like it may make sense to go back to the D7 approach of treating this as a multi-step form that forces the selection of the form first. This would also prevent folks from filling in fields prior to selecting the form and then missing the newly added fields...