Why does updating a large VARBINARY break replication (MSSQL_REPL21100)?
After much frustration and fruitless googling, I finally figured out the problem. It was not that the accounts for the 'SQL Server' and 'SQL Server Agent' services did not have access to the directory. The problem was that the account for the 'Log Reader Agent' did not have access. Should have been obvious from the error message, but I just didn't get it...

On the publication server, run this:

USE DatabaseName
EXEC sp_helplogreader_agent


The job_login column will tell you which account runs the Log Reader Agent. Grant that account read/write access to the directory and everything works fine.