Ah, yes I think you've closely described what's been happening below. The users I'm testing with aren't always forthcoming with details. So it looks like they have been moderating these intermittent senders all along but blamed Mailman3 since it's "new". I wasn't aware of the non-member record being created post moderation, so I was confused as well. I've asked them this morning about a specific list member who has an alias subscribed, but occasionally emails using their official user email and has their message moderated as a result.
They confirmed that they've always moderated those messages but never followed up to configure the address as an accepted non-member. Therefore the non-member was created and set to "List Default". I've advised that they can now follow up and adjust that setting to avoid future moderation of those addresses. Thanks again!
"Also, I don't know if this is possible given your list create/import scenario, but if there is a window between list creation and the import, if the non-member posts during that window, a non-member record will be created with moderation_action = List Default and the import won't change that."