Azure AD Service Principal client credentials grant 535: 5.7.3 Authentication unsuccessful accessing smtp.office365.com via XOAUTH2 SASL SMTP

I have followed this guide on how to use client credentials grant flow to authenticate IMAP.

https://docs.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth#use-client-credentials-grant-flow-to-authenticate-imap-and-pop-connections

The app registration has the following permissions:

I have successfully given my application's service principal access to the mailbox I wish to read:

Add-MailboxPermission -Identity "john.smith@contoso.com" -User <SERVICE_PRINCIPAL_ID> -AccessRights FullAccess

And the application's service principal has SendAs rights to the mailbox used.

Add-RecipientPermission -Identity "john.smith@contoso.com" -Trustee <SERVICE_PRINCIPAL_ID> -AccessRights SendAs

https://serverfault.com/a/1110785

https://learn.microsoft.com/en-us/exchange/recipients/mailbox-permissions?view=exchserver-2019&viewFallbackFrom=exchonline-ww

The obtained access token looks good with roles matching what I want to do:

I have used both Microsoft.Identity.Client and System.Net.Http.HttpClient to get a token successfully and I have used MailKit.Net.Smtp.SmtpClient to send emails. I can get access to the mailbox via IMAP using MailKit.Net.Imap.ImapClient. See this question:

Azure AD Service Principal client credentials grant AUTHENTICATE failed accessing outlook.office365.com mailbox via IMAP

IMAP and SMTP settings from:

https://support.microsoft.com/en-us/office/pop-imap-and-smtp-settings-8361e398-8af4-4e97-b147-6c6c4ac95353

The guide does say:

Note As per the current test with SMTP Oauth 2.0 client credential flow with non-interactive sign in is not supported.

https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth#smtp-protocol-exchange

What I can't understand is why they then have a Office 365 Exchange Online Application permission called Mail.Send that Allows the app to send mail as any user without a signed-in user. Application permissions states that they should be used when Your application runs as a background service or daemon without a signed-in user.

Similar question:

Office 365 XOAUTH2 for SMTP on native clients 535 5.7.3 Authentication unsuccessful

Using Mail.Send with Delegated permissions I can send an email using SMTP with the mailbox I wish to send as. Code example for that:

https://stackoverflow.com/a/73728638/3850405