Escalating from one unprivileged account to another, for example connecting as a deploy user and using become_user: appuser, makes Ansible fail with Failed to set permissions on the temporary files Ansible needs to create when becoming an unprivileged user. The connecting user writes the module into a temp directory that the target user cannot read, and neither can chown it.
The supported fix is to install acl on the managed host so Ansible can grant the second user access with setfacl. Where the filesystem does not support ACLs, setting allow_world_readable_tmpfiles = True in ansible.cfg works by making the temp files world readable, which briefly exposes any secret passed to the module and is documented as a security tradeoff.
The problem does not appear when becoming root, because root can read anything, which is why it surfaces only on the first task that targets a service account. A third option is to connect as the target user directly and escalate only for the tasks that need root. Ansible has behaved this way since the become system replaced sudo-specific handling in 1.9.