PrivateTmp=yes mounts a fresh, empty /tmp and /var/tmp for the service in a private mount namespace. Anything the service writes there is invisible to other processes and is deleted when the unit stops. Distribution unit files enable it widely, so a service that communicates with another process through a socket or a lock file in /tmp fails with 'no such file or directory' while the file is plainly visible in a shell.
Diagnose by comparing what you see with what the process sees: read /proc/PID/root and /proc/PID/mounts, or run 'systemd-run --pty --property=PrivateTmp=yes ls /tmp' to reproduce the empty view.
The same class of surprise comes from ProtectHome, which hides or empties /home and /root; ProtectSystem=strict, which mounts the whole filesystem read-only except for paths named in ReadWritePaths; and ProtectKernelTunables, which blocks writes to /proc/sys. Each produces a permission or missing-path error from code that works when run by hand. 'systemd-analyze security NAME' lists which of these a unit has enabled, which is the fastest way to see what has been taken away.