The reason this is done is that flush sends post_syncdb, and permission & contenttype creation are listening for the signal.

This seems to be one point more for override_settings() based approach. If done that way, permissions & contenttypes could register a listener for settings_changed and add/remove the signal listener as needed. No need to know about "app mask" at all.