Have SB using SC 20.1 and Prod using 20.2... can use 20.2 tool to get a token but unable to fetch from SB. Is this as simple as needing to update SCEM in sandbox?

You need to have SCEM 20.2.1 in order to use TBA

Thanks Flo. Given that its a managed bundle (as is SC bundle of course), can I go to support to ask them to authorize 20.2 in SB? Alternatively, the option would be to manually add the theme or extensions to 20.2 tools and push to the prod account, ya?

Sandbox account are not updated automatically, you need to do the update yourself.