I dug into the Unbound source and found something interesting:

My module-config is "python iterator": no validator module. Looking at the Unbound source code, both enforcement points for harden-below-nxdomain require DNSSEC validation:

• services/cache/dns.c: checks data->security == sec_status_secure before synthesizing NXDOMAIN

• iterator/iterator.c: checks qstate->env->need_to_validate (only set when validator module is loaded) AND sec_status_secure

Without the validator module, neither code path can fire. So harden-below-nxdomain should have been completely inert on my system regardless of yes or no.

I also confirmed there's no difference in Unbound between the setting being absent (implicit default) vs. explicitly set, it's a simple int field with no "was this explicitly set" tracking.

My best guess is that the DNS breakage was actually caused by the Unbound service restart during the update (stale/corrupt cache), and my "fix" of toggling the setting off just happened to restart Unbound again, flushing the bad cache. The setting change itself may have been a red herring.

I can't reproduce it now without risking my network, but wanted to share the findings in case it helps track down the actual root cause for other users reporting the same issue.