I found out what it was. At some point in the life of the site, I must have installed a theme or plugin that altered the user capabilities in the wp_user_roles table of the database. So deactivating and even deleting plugins and themes had no effect because many still leave their tables and configurations in the database.
I copied over the user capabilities from a fresh install (which does allow authors & editors to upload files) and the problem was fixed!
Thanks for the suggestions DouglasDetrick – I was so close to going with a plugin for this and User Role Editor looks like a popular one so I’ll keep it in mind for the future!