There also seems to be a separate issue where freshly created apps, or apps upgraded from older version of Cordova will have cordova-plugin-whitelist@1 installed automatically.
For some reason, this version of plugin does not work when installed in this automatic way (including the version installed by cordova create!) even with proper CSP and access tags.
Removing plugin and replacing it with cordova-plugin-whitelist@latest seems to fix the problem, up to and including to cause subsequent reinstallation of cordova-plugin-whitelist@1 to function properly.