CVV is being required in backoffice, even when it shouldn't be
This isn't a full answer, but we (Karin actually) discovered that by removing the redis caching configuration from the civicrm settings file, the problem went away.

This is a bit weird, since the problem I was looking at was the static code cache, but it sort of makes sense if the api call that pulls in the payment object could potentially be reading from the more permanent (usually mysql table) cache.

So, my best guess to this issue is that there is some code somewhere that is accessing the CiviCRM cache without using or knowing about the use of Redis.

On it's own, this just means we can't use the Redis cache for CiviCRM, but it suggests that there might be a bigger problem hiding in here.