Good point, I tested again on a new profile with no extensions, and the SSO flow still didn't work. However, when I disabled only "Enable Content Blockers", then the flow works correctly.
To your questions, I think I would take some inspiration from Chrome and occasionally break features in favour of compatibility. You could potentially relax (or outright disable) content blockers on appleid.apple.com. You'd likely have to manually maintain a list, but it would be invisible for users. For users that prefer the occasional broken website to losing privacy, you could include a control to disable that automatic relaxing. Of course, you could also do this in reverse, allowing users to opt-in to that invisible disabling of content blockers in favour of a browser that Always Works™.
In terms of compatibility mode, one option would be letting users know when they're on websites for which there have been (any) feedback reports against. Something like "Users often report issues with this website on orionfeedback.org. Enable compatibility mode?" Of course, if you have telemetry on where compatibility mode is enabled, this would be even easier.
