Ok I was premature on the above. This fixed some other errors but to get rid of the oAuth errors the only solution was to raise a support case with GCP, they then contacted google ads team who, and I quote
“Kindly note that the Google Ads Engineering Team granted the admin role to the service account mentioned.”
It looks like they’ve manually accepted the invitation somehow in the backend, which we have no access to do as it’s a SA, and the docs say an invitation never needs accepting.