Unexpected 403 in Sharepoint rest api list items roleassignments call

We created a sharepoint add-in with the follow permissions:

<AppPermissionRequests AllowAppOnlyPolicy="true"><AppPermissionRequest Scope="http://sharepoint/content/tenant" Right="Read"/></AppPermissionRequests>

My understanding is that an app with tenant scope permissions should be able to read all the site contents. In this case the call to

/_api/web/lists('<id>')/items(<id>)/roleassignments 

fails with the following error:

Client error 403

{
    "odata.error":
    {
       "code":"-2147024891, System.UnauthorizedAccessException",
       "message":
       {
           "lang":"en-US",
           "value":"Access denied. You do not have permission to perform this action or access this resource."
       }
    }
}

Note that a call to /_api/web/lists('<id>')/items(<id>) for the same item works fine. The roleassignments call with tenant permissions is also working for one of the SPO instances but not for a different one.