Sorry about the delayed reply to this. Your suggested fix will work.
The webhook request is being validated in the call to verify_discourse_webhook_request, but there isn’t an explicit permission_callback on the route - it sounds like that fails in WordPress 5.5. I had thought it would just give a deprecation warning.
I’ll update the plugin with your suggested fix for now. Later we can look into calling the verify_discourse_webhook_request from the route’s permission callback instead of from the its callback.
Edit: WP Discourse version 2.1.4 adds an explicit permission callback to the update-user REST route. It’s in the WordPress repo now.