tmutil doesn't create a real snapshot (since Catalina?)
I'll answer myself, though it's a partial answer.
When tmutils is used with partitions like /, the result isn't a true snapshot, the file system I mount this way reflects the original one in real-time (ie, any change in the original is immediately visible in the &quot;snapshot&quot;).
In order to make it work, I have to mount partitions like this:
vol_path=/System/Volumes/Data
snap_id=$(tmutil snapshot &quot;$vol_path&quot; | sed s/'Created local snapshot with date: '//)
mount_apfs -o rdonly -s &quot;com.apple.TimeMachine.${snap_id}.local&quot; &quot;$vol_path&quot; snap-mnt

This works fine when you want to backup a subdirectory like /System/Volumes/Data/Users/user/.
The flip side is that directories like /etc aren't under Data/, but /etc/ is actually a link to Data/private/, so one doesn't lose much by backing up the Data/ dir only.