OK, I seem to have found a way to do this in CMake.
At least Testflight didn’t send me the dreaded email about the last submission but there is no way to get positive confirmation that it’s correct.
set(PRIVACY_INFO "path/to/PrivacyInfo.xcprivacy")
target_sources(MyPlugin_AUv3 PRIVATE "${PRIVACY_INFO}")
target_sources(MyPlugin_Standalone PRIVATE "${PRIVACY_INFO}")
get_target_property(RESOURCE_AUV3 MyPlugin_AUv3 RESOURCE)
get_target_property(RESOURCE_STANDALONE MyPlugin_Standalone RESOURCE)
list(APPEND RESOURCE_AUV3 ${PRIVACY_INFO})
list(APPEND RESOURCE_STANDALONE ${PRIVACY_INFO})
set_target_properties(MyPlugin_AUv3 PROPERTIES RESOURCE "${RESOURCE_AUV3}")
set_target_properties(MyPlugin_Standalone PROPERTIES RESOURCE "${RESOURCE_STANDALONE}")