Application authentication exact certificate match

In our setup we are using API security mechanism 'application authentication' to implement MTLS scenario for some of the most critical integrations. 
According to it the private key holder (of the client certificate) initiates API request which is being compared:
1) against CA Truststore defined in APIC CMC inside TLS profile -> initial check against issuer of the certificate if the issuer is trusted
2) against actual client certificate defined by the customer in Developer Portal
As per discussion in IBM Case we learned the behavior for client certificate comparison (between client request and developer portal) significantly changed in one of latest releases (without any announcement) and currently customer can also register intermediate certificate (issuer of the client certificate) in the Developer Portal.

In such a configuration, the security of the application may effectively be reduced to possession of the client ID and client secret plus possession of any certificate acceptable under the registered CA hierarchy as any certificate signed by the same issuer pass the validation. The mTLS connection itself is still cryptographically valid, but it is no longer necessarily bound to the specific client certificate belonging to that API Connect application.
What's more we don't have a control of which customer is registering what and we can't effectively block it without custom development.

The idea considered here is to mitigate the issue introduced by discussed change and add toggle mechanism so API Connect administrator can decide if exact client certificate comparison between request and application configuration should be enforced. Ideally the solution shouldn't force our API Providers to redeploy all the APIs.