Other random ideas here.
a) You can tweak the code generation of RuntimeEnabledFeatures (or RuntimeEnabledFeaturesBase) and define a static member function FooRevertedEnabled() { return !FooEnabled(); }.
b) You can tweak ContextFeatureSettings (See [ContextEnabled=MojoJS] and ContextFeatureSettings::isMojoEnabled()). You can (technically) add a new member function isFooRevertedEnabled() { return ! RuntimeEnabledFeatures or something else ::isFooEnabled(); }.
Note that RuntimeEnabledFeatures(Base) is auto-generated by a script based on runtime_enabled_features.json5. It will look tricky (IMHO), but you can add something hard-coded in:
//third_party/blink/renderer/build/scripts/templates/runtime_enabled_features.h.tmpl
//third_party/blink/renderer/build/scripts/templates/runtime_enabled_features.cc.tmpl
Note that ContextFeatureSettings itself is not so welcome from my perspective (RuntimeEnabledFeatures should be used instead) and it's used only for Mojo so far. But you can technically add a hack there.
Anyway, you need to fix the flag value until when the bindings layer installs context-dependent properties. Otherwise, the bindings layer does / does not install the property based on the flag value at that moment.
Cheers,
Yuki Shiino