I thought I’d close by sharing what a support professional told me:
This restriction is due to how we handle the relationship between the username and nickname fields in native Auth0 identity providers (i.e. database, custom database with import mode on) when the Requires Username feature is enabled.
Unfortunately, given your connection type we can’t remove this restriction.
They agreed that if you have to update both nickname and email or username, it needs to be done in two separate API calls; that seems to be the best workaround.