If the system does not require Internet sharing, support for it is non-essential and _MUST_ be disabled. The information system _MUST_ be configured to provide only essential capabilities. Disabling Internet sharing helps prevent the unauthorized connection of devices, unauthorized transfer of information, and unauthorized tunneling.
This is implemented by a Configuration Profile. mobileconfig profile info: com.apple.MCX: forceInternetSharingOff: True