Does that negate all the benefits though?

If a single component of your application maintains a little state, say the API Gateway, and all the downstream services simply get a clean JWT they can trust with all the right claims in it?

I'm thinking this is still nicer than having every downstream service also having to check auth claims against some datastore.

Exactly. Even if it's not a SPOF, it becomes yet another piece of architecture you need to worry about distributing and scaling (if you're at the point where JWTs are attractive to you due to their scalability).