Okay, so the docs also describe the requirement for testing the applicationId claim:
Unfortunately the application feature Registration
->Self-service registration
doesn't work for token requests. And OAuth
->Require registration
doesn't work for password grant type.