Access denied for specific role
We had the same issue and same resolution, but agree, it doesn't feel right. I opened an issue in the lab but couldn't find anything else: https://lab.civicrm.org/dev/drupal/issues/45

EDIT: Maintainer/owner "colemanw" replied to the issue: 


  Looks like "access CiviCRM" was recently renamed "access CiviCRM backend and 
  API" I assume to enhance clarity but it seems to have caused some confusion.
  But it's true, you should only allow trusted users to access your CRM.


EDIT2: More info from colemanw:


  Right, "access CiviCRM" or whatever it's called now is the gatekeeper, the minimum permission needed to access any part of CiviCRM. It is required to have that permission before doing anything.


Looks like we had the right idea!