Ok, I figured it out. Has nothing to do with the Quip snippet itself:
Generally speaking, I save templates and chunks as files on the server, so I can edit them more easily. The chunks in the database contain nothing more then a tiny snippet that reads the chunk file
Like this:
[[includeChunk? &chunk=`path/to/chunk.html`]]
It turns out that this way of handling the Quip chunk doesn't work as expected.
When I save the contents of the chunk file in the database, all's fine.
Seems like a security problem?