is permissions for sharing a site via ShareSite changed

I'm seeing this now as well, and maybe I can provide some additional context. I'm inviting external users via app-only context. This used to work, and now it does not.

I believe it has something to do with classic versus Modern sites. I have a tenant where app-only invitations still work on classic team sites but fail on Modern sites. Tenant and site settings are configured to allow sharing to existing and new external users. I have another newer tenant, where the functionality is disabled altogether. 

I'm running: 

var group = ctx.Web.SiteGroups.GetByName(groupName);
ctx.Load(group);
ctx.ExecuteQuery();

group.InviteExternalUser("user@domain.com", true);
ctx.ExecuteQuery();

and the code does not throw exceptions but the invite is not sent. Sniffing the traffic with Fiddler I can see:

The user has insufficient permissions to create an invitation

Anybody know what's going on here? Really would like to avoid the Graph workaround if possible.