Why would !order-summary token be available/unavailable depending on payment method?
Of course I find the issue after posting the bounty :s

This Commerce Message issue explains that the problem is that some payment methods need to do a postback, which is executed as anonymous user. This apparently means that the view which returns the order summary (commerce_cart_summary) is also executed as anonymous and returns no results, so the token remains empty. The commerce_payment_example method does not have this problem because it doesn't rely on any external feedback.

The workaround to disable SQL rewriting in the commerce_cart_summary view works (I haven't tested the patch yet).