Should the namespaces kube-system and istio-system be labeled for sidecar injection as well?
No, it should not.
It's against security rules.
sidecars cannot be injected in the kube-system or kube-public namespaces
sidecars cannot be injected into pods that use the host network
Please read this Sidecar Injection Webhook