Looking at an older Debian Buster install with only Xfce, it looks like Buster's Xfce installed a Policy Agent from the GNOME desktop and it is enabled by default.
On Buster's Xfce the Policy Agent is polkit-gnome-authentication-agent-1. So I would say the issue here has nothing to do with Synaptic Package Manager as such, but with the Xfce install that leaves out a Policy Agent. Of course this means there is potentially more stuff broken than just Synaptic.
