What user roles should have wp_unique_post_slug_is_bad_flat_slug filter applied?

Actually you should skip the condition altogether – you don’t need to worry about permissions or context here, you are merely saying:

If WordPress, for whatever reason, is determining if a slug is bad: run my additional conditions

Currently, if a theme/front-end plugin/REST API call was triggering the filter (i.e. insert/updating a post), your checks aren’t going to run (is_admin() is false) – just always attach the filter and let WordPress take care of the rest.