Ahhh, sorry. I misread your issue.
Okay, I've now solved the problem. Here's the explanation in case anyone else encounters the same issue:
There's a filter for <Users and Groups> (DataSources). This filter is applied to a WHERE clause for the view "V_CachedOrganisationStructure" when saving.
The underlying table is CacheOrganisationStructure (which contains all users and groups).
If the service user (in our case, "Serviceuser Webcon") is not included in the view, it cannot be added to an app permission.
I have now added this service user to the filter and subsequently granted them permission in the app.
From this point on, all REST downloads in this app work as expected.