Since this seems to be a persistent issue and no forums give a good answer, I have been able to work with Google Support and have a solution for G Suite users. Note that you will need the G Suite admin to make changes to Mobile Device Management on iOS devices.
For some background, I have a two year-old G Suite domain that I just started using daily. I had only been using the Gmail app on iOS (iPhone and iPad), and everything worked fine. It was only after I recently tried to add my account to iOS for Calendar and Contacts for the first time that I ran into this problem. I only have one account on the domain at the moment, but that account is protected with a second-factor using a Titan Key. I don't know how much that matters, but I haven't tried on an account with no additional protection. But, I noticed in the G Suite Admin that new iOS settings have been added to the console, indicating that something has changed on iOS access to G Suite. The domain was set to Basic management of all devices, but dropping that to "Unmanaged" didn't seem to fix the problem.
For the solution that has worked for me, I reluctantly agreed with Google Support to change iOS management to Advanced in the Admin Console/Device Management/Setup/Mobile Management under the Custom bullet. Changing to Advanced requires setting up an Apple Push Certificate. Instructions were there and easy to follow for getting a certificate request from Google and then going to Apple to get the signed certificate (no cost). Unfortunately, doing this appears to log out any iOS user accounts from the Gmail app. Logging back in worked as expected, though.
I tried again to add the account to iOS and failed. I decided to delete one iOS device from the approved devices list (Google Admin/Device Management/Devices). Doing that killed Gmail access again, but this time, when I logged in, it prompted me to download the Google Device Policy app. Once I did that, the device was under domain policy control for the account I was trying to add. After accepting the ToS, it prompted me to select an account, pre-populated from the Gmail app, I assume. Then, it prompted me to download the G Suite domain policy. Once downloaded, you go into iOS Settings, and "Profile Downloaded" should appear at the top. After clicking that, I clicked "Install" and entered the iOS passcode. Confirm install and trust the provider to complete the profile installation.
Of course, I then tried to add the account again and failed. So, I changed the iOS settings in the G Suite Admin Console to "Push Google Account configuration" (G Suite Admin/Device Management/iOS Settings/Account Configurations). Going back into the Google Device Policy app on the iOS device, I manually refreshed the policy. It prompted me to authenticate the account, and boom, it put me into the iOS Settings for the Account, now finally allowing me to toggle Mail, Calendar, and Contacts as you would expect. Everything seems to be working now.
Note that I don't know how much of this is necessary or why it seems necessary now when I haven't had to deal with it before. I'm thinking that new accounts added to existing domains are having the iOS account install issue because Apple has changed it's device access policy, but G Suite accounts that were already installed on iOS have been grandfathered in without having to go through the certificate process. That said, I tried resetting the iOS device management policy back to Basic, and that removed the G Suite domain profile from the iOS settings, removed the user account, and caused a repeat of the original failure scenario.