We also ran into this issue and like Berdir mentions we think the updates are applying in an order that prevents the new permission assignment from completing correctly.
Commenting out;
function webform_post_update_authenticated_user_permission() {
user_role_grant_permissions('authenticated', ['use text format webform_default']);
}in /modules/contrib/webform/webform.post_update.php does allow the updates to proceed.
We then ran the updates again with that final update available and it applied cleanly.
Dafydd Owen → made their first commit to this issue’s fork.