I just ran this for a ProductVariantUpdate using the GraphiQL app in my test store. It worked fine. See below. I didn't have an exiting product with a defined metafield so it was against a variant child, but seemed to go okay. And you've verified that this particular Shopify account has the appropriate permissions? I know you said that it's the root account, but double-checking might not hurt!
Well, you were right! Thx for insisting.
I wasn't able to review full rights of the application (or at least they were misleading) but eventually I reinstalled it and it worked.
Side note: it seems to me that the example here: https://shopify.dev/tutorials/manage-metafields-with-graphql-admin-api#updating-the-owning-resource
Lack with the field
Otherwise you get a: "message": "Key must be unique within this namespace on this resource"