I missed that bit on the original post.

We've automated our SQL installs.  Since 2012, the scripts have added the service account to that local policy (and a few others too)...