For other people who hit this problem: yes, it was the file filter.
I didn’t want to allow PHP files globally. I created wp-content/plugins/wc-product-customer-list/output/.htacces and allowed PHP files there.
I now get my .csv exports from this plugin.
Thank you, kokomo! I literally NEVER would have guessed I needed to allow php files.