ok Bresnik has a new version of Tinkertool called "Tinkertool System", and it has a panel to set and propagate ACLs. That appears to have fixed the issue, I just wiped the ACLs from the entire thunderbird profile and the backup appears to be proceeding happily now. Must be a Thunderbird bug? That probably means it'll cause problems again down the road...
The first ~20 ACLs were pairs of "custom" and "full access" ACLs, the first of each pair denying the user READ access to the object. Weird. Not sure why the user could read them at all, since technically the first ACL that hits usually applies and stops evaluation, and that would have locked them out of their files. I only tried to copy the files, not open them, maybe you can copy files you can't read? *shrug*
