The MTLS test failures in XdsSecurityClientServerTest are because you changed isMtls etc to check certHandle and rootCertHandle members instead of the certInstance and rootCertInstance members.
When executing

certHandle = certProviderInstanceConfig == null ? null
          : certificateProviderStore.createOrGetProvider(
              certInstance.getCertificateName(),
              certProviderInstanceConfig.pluginName(),
              certProviderInstanceConfig.config(),
              watcher,
              true)::close;

the file watcher cert provider already makes the callbacks for certs and roots and before this statement returns, both updateCerts and updateTrustedRoots are called, and they see that certHandle and rootCertHandle members are null, so no update happens and the Tls handshake times out after 10s.

I think we should revert the changes in isMtls etc to still continue to check certInstance and rootCertInstance member variables that were initialized earlier in the code flow.

I do like the approach, I will fix the tests and incorporate my changes on top of this.

I have incorporated these changes into my PR #12340 with the fixes.

the file watcher cert provider already makes the callbacks for certs and roots and before this statement returns

Ah, yes. I had seen that was a risk while working on this code, but I ended up stepping on it. I do think we should adjust isMtls() and friends are computed to make it less bug prone, but I agree with not doing it right now.

Closing, as this PR has been integrated into #12340.