You're trying to debug the server by looking at the client output. This isn't the right approach. All of the documentation says to run the server in debug mode, and then read the output.

In this case, radclient has the blastradius mitigations added to it. i.e. it's always sending Message-Authenticator in Access-Request packets, even when the input file doesn't explicitly include Message-Authenticator.

Run the server in debug mode, and read the output. You will see that it is receiving an Access-Request which contains Message-Authenticator.