capabilities in AppArmor profile vs extended attributes

"Exercise 35.2: Exploring apparmor security"

In this lab we copy /bin/ping to /bin/ping-x and set it's net_raw capability to permitted and effective:
setcap cap_net_raw+ep /bin/ping-x

Then we generate apparmor profile:
aa-genprof /bin/ping-x

After that if i unset net_raw capability:
setcap cap_net_raw-ep /bin/ping-x
it doesn't work:

socktype: SOCK_RAW
socket: Operation not permitted
missing cap_net_raw+p capability or setuid?

Generated apparmor profile already contains capability net_raw, so why it doesn't work without cap_net_raw=ep set in extended attributes? How it's different?