fetch_id_token checks only GOOGLE_APPLICATION_CREDENTIALS env var. It is not checking the well-known location (.config/gcloud/application_default_credentials.json) where gcloud writes the credential.
Ideally we should check both locations like how the Access Token Cred ADC does here.
Due to this bug, if user ran gcloud auth application-default ... command and runs id_token.fetch_id_token, the cred is not picked as expected.