Interestingly, I did not know about power-profiles-daemon at all… there’s a Debian package, but I don’t have it installed… another thing to mess with I guess?
Also, I have just tested with just:
USB_DENYLIST="0bda:8156"
… and not USB_AUTOSUSPEND=0 in my tlp.conf and it seems the NIC still goes to sleep the wrong way.
So I’m not sure that’s a valid workaround here… which is unfortunate because I now have the distinct feeling that disabling autosuspend across all USB hurts my suspend performance quite a bit… Still needs to do benchmarks on that. 
Update: seems like USB_DENYLIST with the kernel commandline usbcore.quirks setting does work correctly, which is encouraging.