In extra.cf you override the mailcow default. Your override was missing the permit that this kind of operation (auto-reply) needs.
Your line from extra.cf:
permit_sasl_authenticated -> NO (no AUTH happened, Dovecot submits the reply without login)
permit_auth_destination -> NO (destination is a third-party domain)
reject -> YES (message is not sent, 554 permanent)
After deletion of this extra line you got this
permit_mynetworks -> YES (uto-reply is initiated from your own container network)
--- rest is irrelevant after a YES ---
permit_sasl_authenticated
defer_unauth_destination
permit
As far as I can say, I’m happy with the mailcow default. Whether you had some special need for that extra line, and what deleting it costs you, or break. I can’t really say.