I am not misunderstanding your situation.
VMX Unrestricted Guest is a virtualisation feature in Intel CPUs that are Westmere and later (although there some exceptions with some Atoms and 2014 Pentiums).
From the error that you encountered, it looks like that ESXi 6.7 requires VMX Unrestricted Guest feature to powerup/run VMs (just like Workstation 14.x on Windows/Linux and Fusion 10.x on macOS). Therefore if the underlying CPU does not have that feature, it will fail. At the very least ESXi 6.7 checks for the availability of the actual feature instead of relying on the spoofed Sandy Bridge family/model/stepping that you applied and that is why you are getting that error message.
The CPUID leaf 1 EAX register is just an Intel product ID in the eyes of the VMware hypervisor software (ESXi, Workstation/Player, Fusion). It does not determine actual CPU features it finds/detects.
ESXi 6.5 still supports Nehalem CPUs (which does not have the VMX Unrestricted Guest feature) and that's why you don't get that error on ESXi 6.5.
You can see it in the VMware Compatibility Guide.
https://www.vmware.com/resources/compatibility/search.php?deviceCategory=cpu