In order to speed up debugging / development I tried the request in curl:
$ curl -D /dev/stdout 'http://example.test/search/ajax/suggest/?q=aaa'
This always returns an empty array. But in the browser it works. Two questions:
1) Where: I can only guess my request missing a session cookie that prevents the search. Where is that coded?
2) Why: Any educated guesses why this has been done and possibly how to turn it off?
To answer my own in part: it needs one of the cookies. Ironically, not the form key nor the session cookie, but the store view cookie.
So the shortest you can get away with is:
curl 'http://example.test/search/ajax/suggest/?q=XXX' -H 'Cookie: store=store_code'