… so I think one fact is established!
You can change security without HO. Nokia and Huawei setup the DRB with PDCP with NR version, so when you effectively add the PSCell, you just need a reconfiguration.
Ericsson, as far as I had logs, was the only one with HO to add PSCell.
This we can do as going to establish a DrB with NR PDCP.
Oh, you were mentioning in the general picture?
Got it
Example …let make mcg bearer with lte pdcp and then during nr cell addition time if you are going to make split bearer.
Then you need to do intra cell handover on lte cell as now mcg bearer security is going to change from lte pdcp to nr pdcp.
Yes, exactly.
Do you mean this can also be done w/o handover?
Yes, no need for HO if you setup the PDCP with NR version.
This is how it works in Nokia and Huawei.
Ericsson still rely on Intra-cell HO.
What about if initially mcg bearer established with lte pdcp?
Then you become Ericsson and do a Intra-cell HO 
Ok but 36.331 says you can’t change security algo of existing drb w/o handover.
Probably security, but not PDCP version, I guess.
Sweet. Thanks for confirming it 