TYPO3 Core

Better not use "Bootstrap::initializeBackendAuthentication();". IMHO it is buggy. There is a workspace-autopublish symfony command, which calls this method before doing the datahandler stuff. Where the same DataHandler call in BE-context works like a charm, the same DataHandler instructions completely do some weird bogus buggy stuff and leaves the whole system in an inconsistent state. Seems like the emulation of "backend context" is not quite complete. So better not use this pseudo initialization of the backend-user.

I don't know about buggy-ness, all I saw was that docs in web and docs in core are mismatching ("use it" vs. "don't use it"). Which could indeed be a hint that this whole thing is buggy as well. ;)

Unfortunately, I don't know either what is the "right" way to do this and what the decision would be.

The core itself - in the upgrade wizard typo3/sysext/install/Classes/Command/UpgradeWizardListCommand.php

uses:

use TYPO3\CMS\Core\Core\Bootstrap;

..

Bootstrap::initializeBackendUser(CommandLineUserAuthentication::class);
Bootstrap::initializeBackendAuthentication();

I have used upgrade wizards from the command line quite often and I assume others have too. No problem so far.

Better not use "Bootstrap::initializeBackendAuthentication();". IMHO it is buggy. There is a workspace-autopublish symfony command, which calls this method before doing the datahandler stuff. Where the same DataHandler call in BE-context works like a charm, the same DataHandler instructions completely do some weird bogus buggy stuff and leaves the whole system in an inconsistent state. Seems like the emulation of "backend context" is not quite complete

So, you are saying the core is currently buggy, if you call the command? Is this in typo3/sysext/workspaces/Classes/Command/AutoPublishCommand.php? Is there a bug report for that - because in that case I think that should get fixed.

The first step for some core developer (whoever wrote this method - I don't know, but wheover was it, must know something about this ;) ) should be to decide whether this method is public API or not. Streamline code doc comments and web docs. Whatever the outcome of this is, must then provide clean instructions on what or what not to do for extension authors (that may do DataHandler-related stuff in CLI context - which is quite common, just think of data import scripts from CSV or foreign Databases that run regularly).