[I've answered my own question below, and for people searching for this issue in the future, I've replaced the question with a summary of the issue.]
In iTerm v3.2.8-9, "auval -a" does not find any 3rd-party plugins.
It has the same issue with utilities, scripts, etc. that have this kind of code:
Apple's Terminal does not have this issue.
I tracked the issue down to a new function that moves "the process from the Aqua 'per-session' namespace to the same user 'per-user' namespace." <- comment in iTerm2 source
iTerm2 Maintainer responded to issue: "For now, turn off Prefs > Advanced > Allow sessions to survive logging out and back in. I plan to revert that commit in a future release of 3.3.x. See #7947"
For more info: