Nice job solving that!
Newbie Question: Using Dropbox as Backup Destination had the same conclusion. The doc you cited has
Paths are relative to an application’s root (either an app folder or the root of a user’s Dropbox, depending on the app’s access type).
The link in above quote talks about how they encourage the app to get a dedicated folder in the Apps folder.
How to manage third-party apps on Dropbox covers the access issue further, and I guess Duplicati chose not to go “Full Dropbox”. If so, that’s a wise approach from a security view, but will makes paths confusing.
Google Drive offers similar security options, but without the different paths, so one can get confused if one copies files in by hand, then wonders why Duplicati can’t see them. I don’t know if Box will do that to you…
Duplicati OAuth Handler when accessed directly does let one get a “full access” Google Drive, but Google plans to make such access hard to get, per Enhancing security controls for Google Drive third-party apps