So, I've just written to the Dovecot mailing list, the reality why Dovecot is complaining is so much worse than anything I could have imagined. While everything indicates Dovecot is able to write to the log files, it seems Dovecot expects execution permissions on the directory it writes the logs to. Because "Standard POSIX permissions for a non-root process to enter a directory." How on earth is that even a thing? Beyond binaries there shouldn't really be any excuse for that many things to have execution permissions on anything.