For the benefit of others the state reflects if a McAfee Agent is installed or not on that VM reagrdless if the VM is already protected with the MOVE "agent-less" AV solution... So I would take it like the ESX will always be "unmanaged" since you can't load a mcafee agent on them.
As long as the MOVE Agenless is there, no need for any AV endpoint, your ESX and VM's will be shown unmanaged.
But you can actual see the status of your VM's in vshield manager console under ESX Endpoint with the description thin agent enabled.
In an MOVE Agentless deployment only SVA would be managed with ePO and protected VM's wont be displayed in ePO at all.
But if you have discovered the VM's via vSphere connector the VM's will get displayed in ePO but the state will be "Unmanaged" as there is no MA installed.