What happens when activating FullWAF?

Hi,
I wanted to find out which settings need to be manually adjusted,
if I export/import custom settings from one website to another,
where ninjafirewall runs out of the box.
The answer seems to be: just the admin e-mail should be checked, if it fits to the other website.

But there is still one open question on my mind.
Are there more things happening in the background then prepending nfwlog/ninjafirewall.php when “Let NinjaFirewall make the necessary changes” ?

This is the reason for my question:

I did some nerdy testing, because I want my custom settings to be deployed on other website by rather non-techies.

So I have activated FullWAF and exported the settings.
Next downgraded back to WP WAF.
“/…/wordpress/wp-content/nfwlog/ninjafirewall.php” has been deleted in the user.ini. so far so good
Then imported these settings.
When I go to Dashboard, it is still FullWAF shown.
After clearing the browser cache and link to and fro some items in the admin, WP WAF is shown correctly.

I tried to raise some more user errors and came to the point,
that NJFW pretends FullWAV is running on an empty user.ini.
The downgrade-button doesn’t lead to any changes any more, until I have even deleted the empty user.ini

Please believe me, I love ninjafirewall, even when I do those ugly things to it. ??
Best wishes
Jürgen