Okay, so the docs also describe the requirement for testing the applicationId claim:
Unfortunately the application feature Registration->Self-service registration doesn't work for token requests. And OAuth->Require registration doesn't work for password grant type.