For sometime now, at least two updates, unknown sources is always enabled. I change in settings then it will be enabled again later. I would like to have it disabled for security.
Do you have any apps installed from the Amazon Android AppStore? How about Amazon Underground?
I can't say for certain, but would not be surprised if Amazon Underground in particular might be able to keep unknown sources enabled (otherwise you would not be able to install anything purchased from the Amazon AppStore or through Amazon Underground).
Again, it is just a guess, but I am wondering about Amazon Underground since, if I understand correctly, it seems to be somewhat of a "portal" to ease finding and installing apps from the Amazon Appstore.
I was wondering if it (Amazon Underground) has the ability to turn it back on on its own. If it is listed in Settings -> Security -> Device admin apps, I'll bet it does...