Update I appear to have fixed it.
I have dtoverlay=pi3-disable-bt
in my config.txt
– this is the standard way to disable Bluetooth on the Pi 3 and Pi 4.
If I comment out this line then reboot, I can communicate with the IoT Hat via /dev/ttyS0
.