Drag-and-drop mail attachment to mac catalyst app – 'Failed to get a sandbox extension'

While dropping a file from Finder into our app works as expected – dropping from Mail behaves differently on the Mac (works fine on iPad):

[session hasItemsConformingToTypeIdentifiers:…] is false for the type identifier of the dragged file. The session only contains an item for "public.url" and that is also the only thing I can ever get from the item provider.

[itemProvider loadItemForTypeIdentifier:@"public.url" options:nil completionHandler:^(NSData* item, NSError* error) { is described to do a coercion: "The contents of the URL is read and returned as NSData" but the data returned is just the NSData encoding of the URL.

The URL is also not accessible –  not even when invoking startAccessingSecurityScopedResource first.

The console reports: Failed to get a sandbox extension I tried adding the com.apple.security.files.bookmarks.document-scope and com.apple.security.files.bookmarks.app-scope entitlement, but that did not help either.