OK, let me answer my own question after some more research:
The error can appear if you have enabled Passwordless account in your Microsoft account Additional security options, as described here.
This effectively removes your "password" entry under "Ways to prove who you are". This setting is separate from configuring a passkey - that's what confused me first.
To summarize: Microsoft Authenticator backup recovery requires a password for sign-in. You will need to disable Passwordless account temporarily to restore your data. Then you can turn it back on.