My named disposable for my vpn had it's firewall cleared

I didn’t set the firewall manually for this named disposabled, but it should have been set according to how I created it.

When I create a named disposable off my disposable openvpn template it inherits the firewall of the template, but I found my named disposable was completely cleared like someone had run qvm-firewall my-sys-vpn reset. That’s only possible if dom0 is owned right? Is there anything that would cause that other than that?