Guideline 2.1 includes an app the reviewer can actually use. If they cannot sign in, they cannot open the paywall. I treat demo credentials as part of completeness, next to products that load.
Notes are the channel
Review notes are not compiler errors. Username, password, what to tap. Short.
The account has to work
A dead demo is a 2.1. I test it on a phone the way I test the paywall.
Subscriptions
If they need to see IAP, the sandbox and Connect story still applies. A demo user with an empty store is the Speech Route screen again.