AWS CDK Why does fetching a secret using ARN works, but using the name reference hangs the deployment?

I have the following piece of code:

Secret.from_secret_complete_arn(
    scope=self._scope,
    id="some-id",
    secret_complete_arn="some-arn-ending-with-6-letters"
)

The secret is then processed and passed to ApplicationLoadBalancedTaskImageOptions's secrets param. Using cdk deploy works just fine.

However, using this code:

Secret.from_secret_name_v2(
    scope=self._scope,
    id="some-id",
    secret_name="some-name-of-the-secret"
)

results in the deployment hanging. I don't really understand why is AWS fine with me getting the secret by complete ARN, but doesn't allow getting the secret by name. If the deploying body has enough permissions to fetch the secret by ARN, why can't it use a name shortcut? Shouldn't it figure out the ARN by itself rather than using the -?????? wildcard?

The answer here suggests granting additional policies in resource permissions themselves, but why is that necessary? Can I instead somehow notify my CDK code to do it for me automatically? Maybe something with the Role construct like below, or with the secret itself?

role = Role(self._scope, "some-role-id", assumed_by=AccountRootPrincipal())
env_secret.grant_read(role)