Thank you, Nicolas.
Now, there's some improvement, but we're not out of the woods, yet.
What happens now after selecting (partial) payment with points and clicking "Finish" is:
I'm landing back at step 1 of the checkout (in my case; address), then with the URL
.../checkout/checkout/show
which isn't ideal, but I could live with it because, when clicking "Next" and going through checkout again, the "Access forbidden" error is gone and pages load properly with URLs
(X being the step number).
But... worse (even worse than before, haha),
the points have not been applied: when going through the checkout steps again, all is the same as before, no coupon applied, no discount for points, and, if I keep selecting points as payment method, I could do this loop forever without ever finishing.
Just for the record: I've only installed a fresh download, nothing else had been changed.
So, still buggy, just differently.
Since you're saying you can't reproduce: if you want me to set up a test site again with full access for you, please let me know, it can be arranged, and I'd get you backend and FTP access per email again.
Thanks for your continuous effort!