I ran Altiris Profiler and found that it pulls the status of SecurityTrustee from ItemActive:
SELECT vi.Name,
CASE WHEN ia.Enabled=0 THEN 'Disabled'
WHEN ia.Enabled=1 THEN 'Enabled'
END AS 'Status'
FROM SecurityTrustee st
JOIN vItem vi ON vi.Guid=st.Guid
JOIN ItemActive ia ON ia.Guid=st.Guid
WHERE vi.ClassGuid='C41F55B8-8CEB-484A-8EDD-1F9F5515F661'
ORDER BY vi.Name DESC