Yes! Ha! In your face! After two days of searching and trying in vain, I figured out that @mailbox_org has two different sets of app passwords...
There are app passwords for email (where you can disable IMAP and SMTP separately). They worked like a charm.
And now I know that there are app passwords in the security section, where one can select if they are for CardDAV/CalDAV, webDAV or Drive.
Because I enabled 2FA in the account settings, I have to use app passwords. Which worked fine for mail not but with calendars or address books. Until now...
Hooray!
In other words: the documentation could be improved and actually mention the two types of app passwords ;-)