The sub-resource ID /subscriptions/......subnets/dnsin is invalid

Question

I have a dnsresolver in a hub vnet deployed with this code:

resource dnsresolver 'Microsoft.Network/dnsResolvers@2022-07-01' = {
  name: 'dnsResolver' 
  location: deploymentLocation
  properties: {
    virtualNetwork: {
      id: hubvnet.outputs.resourceId
    }
  }
	resource inendpoint 'inboundEndpoints@2022-07-01' = {
		name: 'dnsresolverin'
		properties: {
			ipConfigurations: [
				{
					privateIpAllocationMethod: 'Dynamic'
					subnet: {
						id: '${hubvnet.outputs.resourceId}/subnets/dnsin'
					}
				}
			]
		}
	}
	resource outendpoint 'outboundEndpoints@2022-07-01' = {
		name: 'dnsresolverout'
		properties: {
			subnet: {
				id: '${hubvnet.outputs.resourceId}/subnets/dnsout'
			}
		}
	}	
}

In a previous attempt I had this:

esource dnsresolver 'Microsoft.Network/dnsResolvers@2022-07-01' = {
  name: 'dnsResolver' 
  location: deploymentLocation
  properties: {
    virtualNetwork: {
      id: hubvnet.outputs.resourceId
    }
  }
	resource inendpoint 'inboundEndpoints@2022-07-01' = {
		name: 'dnsresolverin'
		location: deploymentLocation
		properties: {
			ipConfigurations: [
				{
					privateIpAllocationMethod: 'Dynamic'
					subnet: {
						id: resourceId('Microsoft.Network/VirtualNetworks/subnets', hubvNetName, 'dnsin')
					}
				}
			]
		}
	}
	resource outendpoint 'outboundEndpoints@2022-07-01' = {
		name: 'dnsresolverout'
		location: deploymentLocation
		properties: {
			subnet: {
				id: resourceId('Microsoft.Network/VirtualNetworks/subnets', hubvNetName, 'dnsout')
			}
		}
	}	
}

And that failed with this response:

The request is invalid, please look into details section for more information. Check the following location for additional guidance: https://aka.ms/azdnsresolver. (Code: BadRequest)

  The sub-resource ID   /subscriptions/../resourceGroups/../providers/Microsoft.Network/VirtualNetworks/vnet001/subnets/dnsout is invalid. It should be a valid Azure resource ID of type Microsoft.Network/virtualNetworks/subnets. (Code: BadRequest)

I would like to understand how the id from resourceId() differs from the success case.

In other words: what is a "sub-resource ID" and why is the id provided by resourceId() invalid?