I had the same issue and solved it by calling startAccessingSecurityScopedResource on the initially resolved URL before getting a fresh bookmark for it (and calling stopAccessingSecurityScopedResource after).
I previously thought you only need to call these methods if you're about to access the file's contents, but it seems that creating a new bookmark from a previously resolved one also counts as "using" the security-scoped resource. The hint to the solution came from the code snippet at https://developer.apple.com/documentation/professional_video_applications/fcpxml_reference/asset/media-rep/bookmark/creating_bookmark_data?language=objc
Topic:
UI Frameworks
SubTopic:
AppKit
Tags: