That document version 3 aka 3.0 (and the corresponding DSS) is 5 years old, the current version of both DSS and (all) SAQs is v3.2.1 from 2018 (although a draft of the next major version, 4.0, is scheduled for comment soon); see https://www.pcisecuritystandards.org/document_library and select Filterby=SAQS. The actual standard which the various SAQs (and audits/ROCs) are designed to implement, PCI DSS (Data Security Standard), is under the default Filterby=PCIDSS, and it says at the beginning of section 8:
Note: These requirements are applicable for all accounts, including point-of-sale accounts, with administrative capabilities and all accounts used
to view or access cardholder data or to access systems with cardholder data. This includes accounts used by vendors and other third parties (for
example, for support or maintenance). These requirements do not apply to accounts used by consumers (e.g., cardholders).
However, Requirements 8.1.1, 8.2, 8.5, 8.2.3 through 8.2.5, and 8.1.6 through 8.1.8 are not intended to apply to user accounts within a point-ofsale payment application that only have access to one card number at a time in order to facilitate a single transaction (such as cashier accounts).
See particularly the last sentence of the first paragraph. Since A and A-EP systems don't actually receive or store cardholder data, it's their ability to control access to it that matters.
SAQA-EP 3.2.1 reflects this, briefly, in item 8.1, emphasis added:
Are policies and procedures for user identification
management controls defined and in place for nonconsumer users and administrators on all system
components, as follows:
but 3.0 did not (according to my saved copy), and even now it's not made obvious this applies throughout all of 8.1.* 8.2.* and 8.3.*. Also note A-EP 3.0 did not include DSS 8.2.2 but 3.2.1 does.
Neardupe To whom do the PCI DSS password requirements apply? which answers essentially the same for 3.2 in 2017, before 3.2.1 was published.