@BDF32E9143B2CD5B are you sure they never work or do they just don't work on the one occasion where you made a workaround? (can you please link that commit)
This is strange to me: the no-auth attribute in eg. toolkit-showcase/src/dbp-person-select-activity.ja line 62 works as you described in Expected beahvoir
I looked at the problem with the specific case with directories-only. I think the problem is in dbp-nextcloud-file-picker.js in line 34: this.directoriesOnly = null.
Here an object is created (and not a bool) and this is ignored by my empty object filter (in adapter-lit-element.js). But if you set this.directoriesOnly = false, then everything should work as expected again and you do not need the other fix (set directories-only to true).
Unfortunately, this is because I filter out empty objects. I don't know if I should change this for such cases or if this is ok because it should be of type boolean anyway.