I submitted a bug report: https://issuetracker.google.com/issues/431938826

Google's responded confirming that the Digital Asset Links caching service makes the call to the server, not the device. This would require the server to be public or at least allow requests from Google's IPs.

Google's enterprise network requirements: https://support.google.com/work/android/answer/10513641
Which links to their assigned IP ranges: https://bgp.he.net/AS15169#_prefixes

(I did request confirmation that there's no workaround for this and waiting on a response.)