So I finally narrowed it down.
- Safe mode on my account = same behavior
- New admin account = same behavior
And the problem turns out to be different from simply the first or second click not coming through:
- If you move the cursor to somewhere, then hold cmd, then tap-to-click => the first, and often second click do not register.
- If you hold cmd, then move to somewhere, then tap-to-click => it always registers
The way I test this is with links in browsers because cmd+click opens a new tab so it's obvious. I've tested this in both Safari and Chrome to make sure it's not a browser issue. Both behave the same.
It appears that tap-to-click is not coming through as long as you haven't moved the pointer since you pressed down the cmd key. The reason the second or third click usually does work, is because by then you have changed the mouse position ever so slightly by touching the pad to click.
That explains why mostly it's the second click that registers but occasionally it's the third or even fourth (depending on how steady your tap gesture is). If it is mouse movement that the system is waiting for, the described behavior is still completely consistent, as you can expect from a computer system.
So yes I'm still convinced that this is a software issue. But it's a mystery to me why this isn't a problem for a *lot* of users.