Hi Robert...yes, I double checked and confirmed that the anonymous access option is enabled. The issue seems to have something to do with the response after the authentication happens. I replicated the same workflow entirely within AGOL by creating a WAB app and sharing it and the associated web map and content to a group with members from another organization. The external users can access the app if they log into their organization, navigate to the group and launch the app, but they cannot if they're sent a link to the app as it resides inside my organization.
When the app is opened from the shared group in another organization, it appends their organizational root domain and works just fine.
Example:
https://MyOrganization.maps.arcgis.com/apps/webappviewer/index.html?id=12345
https//YourOrganization.maps.arcgis.com/apps/webappviewer/index.html?id=12345