Follow-up:
I get the same behavior (enter Apple ID + password, followed by entering password twice more) for first IAP in both TestFlight and when using a sandbox account.
A second IAP purchase works as expected (enter your password just once).
I took Apple's StoreKit 2 demo app, changed the Bundle ID, created an app on App Store Connect with all the same IAP items in the demo, and purchased items through a sandboxed account. I get the same behavior from Apple's demo code: enter Apple ID + password, followed by entering password twice more.
I went ahead and submitted the app for review. I hope the non-TestFlight and non-Sandboxed behavior (i.e., a real user purchase) is better. Fingers crossed!