Recently we've faced an issue with "safe removal" of a PCI device (network adapter) from the Windows guest OS side. So, if you perform the removal operation from the guest OS, then the device will be removed from the VM configuration. This is a known behavior, and I could disable hot-plug for the VM to workaround this issue, however I would prefer the way, which is described in https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-F88A5FED-552B-44F9-A168-C62D9306DBD6.html. I've used this hint way back in the past on vSphere 5.0/Windows 7 guest OSes, and it was working properly, if I remember it right.
I was trying to do same thing on the vSphere 6.7u1 with VM HW14, but I was able to "safely eject" PCI devices from the guest OS even after the entries "isolation.device.connectable.disable" & "isolation.device.edit.disable" were added to the VM advanced configuration.
I was trying to use values "true", "TRUE" and "True", I was trying to add configuration entries via the web client and via powershell. Still no luck.
Is there any problems now with these advanced configuration parameters?