Unlike the server, mariabackup does not accept hashicorp-key-management-token as a command-line option and does not read it from the config file; and it cannot get it from the server because it's not a variable.
So, apparently the only way to make mariabackup prepare a backup from a hashicorp-ed server is by configuring VAULT_TOKEN in the environment. It is far from obvious and needs to be documented.