Quick followup: I figured it out, the error can be circumvented by setting up the Suica card via Google wallet (the Play Protect restriction doesn't apply to Suica for some reason). To do that you have to give Play Services SMS and phone permissions.
After you set up the Suica through Google Wallet, you can either keep using it there (with the benefit of having a properly translated UI) or continue using the card inside the Suica app (Suica app and Google Wallet appear to share Osaifu-Keitai data). The latter has the benefit of not requiring any permissions given to GServices.