Thanks @apparentlymart, this workaround works.
But it is, to say the least, less than ideal.
Is there a reason there couldn’t be an -insecure mode to both plan and apply? This could be handy in combination with -target. Is it something that could be contributed by the community (I might give it a shot).