The solution in
LPS-29066 is too late in our case because we need to disable PACL so that it doesn't get into PACLPolicyManager -> InactivePolicyManager -> DeployManagerUtil#getInstalledDir -> .. -> PortalPreferencesLocalServiceUtil#getPreferences -> Exception thrown
LockLocalServiceUtil#clear gets called in StartupAction before the database tables are upgraded/added. So if someone is upgrading from a version that doesn't yet have the PortalPreferences table, they will get no such table exceptions.
We need to turn off PACL/InactivePolicyManager uses until after DBUpgrader.upgrade().