So the mystery is now apparently solved. The 3rd password required (apparently) was the macOS user password of the account where I use the same Apple ID on my Mac.
This password was not accepted in the third verification step in my case (apparently) because I had used the same Apple ID (partly for testing purposes in relation to this very issue) with different user accounts on that Mac. This is clearly a corner case, because most Macs presumably only have single accounts installed.
The issue went away by choosing "Forgot Mac Password?" and then "Reset Encrypted Data" when iOS prompted for the 3rd password. The detailed description of the last steps reads as follows:
End-to-end encrypted data stored in iCloud will be permanently
deleted. This may include Messages in iCloud, saved passwords and home
data. Are you sure you want to continue?
I've been told that despite of this description what would be deleted is only credentials, and the fact that I can still see e.g. calendar items shared via iCloud on both my iPhone and Mac after performing this procedure seems to confirm this.
After this intervention, iOS no longer reminds me that I should "Update Apple ID Settings" and everything seems back to normal.