You know what, that’s exactly what it was. I was so thrown off by the 200 - OK I was getting that getting back a “blank” response didn’t even cross my mind. It makes perfect sense now.
Although, I still think there should be some 4XX error code. Sending back a 200 - OK and a blank response just seems like a false positive, because that legitimately could be a real result if a user actually has no active extensions.