I checked with my Gentoo system which uses `sysctl --system`, and it too can override any admin settings defined in `/etc/sysctl.d/*.conf`. It appears that the files are processed in the order they are listed in the `sysctl.conf` man page.
`sysctl --system` has the same issue as the OP described and should therefore **not** be used. I will file a PR for fixing the order, so that local admin settings never get overwritten by "vendor" settings.