The solution seems quite simple: subdomain_matching has to be enabled.

app = Flask(__name__, subdomain_matching=True)

The problem IMO is that in this moment Flask documentation is not so clear about this.

In particular the documentation quotes:

SERVER_NAME "Must be set if subdomain_matching is enabled, to be able to extract the subdomain from the request."

but I couldn't find where it explicitly says that since 3.1.0 setting SERVER_NAME alone doesn't activate sudomain_matching anymore.