I managed to solve this problem using ds_is_from_list in failure_route like this:

ds_is_from_list("8201", "3", "sip:$T_rpl($si):$T_rpl($sp)"))

But I don't understand why I needed to do it that way.

I would still like anyone to explain if they know the reason!

per my understanding in the failure route you are in the context of the original INVITE message, so without explicitly telling ds_is_from_list the IP address it is checking based on the source IP of INVITE.

Andrew