Pretty sure this is caused by known bug in dovecot that exists in versions 2.3.11 thru .16, fixed in 2.3.17.
Basically doveadm pw fails because it insists on accessing all files mentioned in the config, even though it’s not going to use them. One such file is the private key, which is set 600 root root, but RoundCube runs the password change as the webserver.
Paul