Grant "Full Disk Access" to Workflows run via the Services menu
The problem is that the automator service inherits the permissions of the application it's running from.

Automator has Full Disk Access. So, if you run it from Automator, it works!

But let's say you're running Chess.app, and from the top menu, you select Chess → Services → My Automator Workflow. Chess.app does not have full disk access, so the workflow fails. I expect that if you grant Chess.app Full Disk Access in System Preferences, the Workflow will work when run from Chess.app—but not when run from DVD Player.app.

Yes, I recognize that this is incredibly frustrating.