So I tried adding the client id and api version into URL parameters, just in case the headers somehow get broken (although I don’t know why it would get broken for just that one endpoint and not the other requests). I also tried to supply an oauth token, just in case that somehow makes it work, but it didn’t either.
The person it doesn’t work for said he tried it on different PCs and over Cable and LTE. There may be others it doesn’t work for, but I only got one other report (and it always worked for myself).
Edit: Also he can open the request URL in a browser (if it includes the client id and version in the URL obviously).