The script runs as a different account than you
Apps Script executes as the account that authorized the script, which is not always the account currently open in your browser. When a script runs from a time-driven trigger, it runs as the trigger owner. When deployed as a web app with "Execute as: Me," it runs as the deploying account. When deployed as "Execute as: User accessing the web app," it runs as whoever hits the URL, but only if that person has also granted OAuth consent. In none of these cases does the runtime account automatically inherit your own Drive permissions.
The first thing to log is Session.getEffectiveUser().getEmail(). Paste that address into Drive and share the target file with it, with at least Viewer access. That single step resolves the error in the majority of cases I have seen. If the file is in a Shared Drive and that account is not a member, you also need to add it to the drive membership, not just share the specific file.
Service accounts used with the Advanced Drive Service follow the same rule. The service account's email (something like [email protected]) needs explicit Drive access, because it has no ambient access to anything in your personal Drive.