As far as I have been able to determine, this is a limitation of the standard Record List component. While it isn't a direct solution to my original question, I resolved my issue by creating a custom aura component. This new component allows for more fine-tuned control of what an experience/community user sees, and maintains those configurations across ...
Things might vary depending on whether you are using a real Login Flow, or a normal Flow on a Login page.
When you are running a Login Flow, then you are not yet authenticated.
So the user is, in fact, the Community's Guest User.
You need to give the following rights :
Community Site : checking "Guest Access to the Support API" might be useful
but unfortunately it doesn't resolve my business need as it seems that ContentDocumentLink records can't be updated via apex or other API called
You can update ContentDocumentLink records via API. Just take a look at the developer help, section supported calls. ;)