See RenderFrameHostImpl::CalculateUntrustedNetworkStatus().

If any descendant frames have ongoing navigations, the promise returned by disableUntrustedNetwork call at the parent frame cannot be resolved.

Note if the frame itself has ongoing navigations, it is allowed to resolve the promise. At the time navigation commits, untrusted network status will be recalculated. If all descendant frames' navigations are done, the promise will then be resolved.