Comment 1 for bug 1933392

The problem is caused by a very old snapd deb 2.21; even though snapd itself re-execs into 2.51, snapctl from the host (i.e. 2.21) is still used when executing snapctl either from the host or from classic snaps. The old snapctl tries to use /run/snapd.socket (and is denied the access), while nowadays snapd expects snapctl to talk via /run/snapd-snap.socket. This can be observed also with 'snap run --shell certbot', followed by manual invocation of snapctl as detailed in the github issue linked in the description.

The problem isn't new though, it must have been the case for a few years already, I suppose the affected snap didn't use snapctl before.